CVE-2019-13309

Vulnerability

In ImageMagick 7.0.8-50 Q16, the function CLIListOperatorImages in MagickWand/operation.c does not properly release image objects when a NoSuchImage error is encountered. Under specific command-line sequences, such as magick -seed 0 -quality 3 "(" magick:logo +repage ")" "(" magick:wizard +repage ")" -quiet -caption "%h%U" -compare -insert 2 tmp, the code path fails to call DestroyImage on allocated image structures before returning, leading to memory leaks via AcquireMagickMemory in MagickCore/memory.c [1][2]. The leaks are present in both the version 7 branch (ImageMagick 7.0.8-50) and in ImageMagick 6 as confirmed by a similar commit [3].

Exploitation

An attacker who can supply a crafted command line to the magick CLI tool (e.g., via a web application that passes user-controlled options or filenames) can trigger the memory leak. No authentication is required if the tool is accessible. The attacker does not need special privileges beyond the ability to run the magick command with the specific arguments that trigger the NoSuchImage error path. The steps are as described: the -insert option causes CLIListOperatorImages to call GetImageFromList with an invalid index, producing a NoSuchImage error without releasing the previous insert_image, reconstruct_image, or p objects [1][2].

Impact

Repeatedly triggering the vulnerable command can cause a denial-of-service (DoS) condition by exhausting system memory. The leak is confirmed by AddressSanitizer output showing a direct leak of 13,504 bytes and an indirect leak of 6,553,600 bytes per invocation [1]. There is no evidence of code execution or information disclosure; the impact is strictly memory exhaustion leading to degraded performance or application crash.

Mitigation

The fix was committed to the ImageMagick repository on 2019-06-29 in commit 5f21230 [2] for version 7, and commit 5982632 [3] for ImageMagick 6. The patch adds DestroyImage calls for reconstruct_image, image, insert_image, and p in the error-handling branches of MogrifyImageList and CLIListOperatorImages. Users should upgrade to ImageMagick 7.0.8-51 or later, or apply the commits to their source builds. No workaround other than avoiding the specific command patterns is available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.