VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 12, 2019· Updated Aug 5, 2024

CVE-2019-14980

CVE-2019-14980

Description

Use-after-free in ImageMagick's UnmapBlob can cause denial of service via crafted file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in ImageMagick's UnmapBlob can cause denial of service via crafted file.

Vulnerability

A use-after-free vulnerability exists in the UnmapBlob function in ImageMagick versions 7.x before 7.0.8-42 and 6.x before 6.9.10-42 [1]. In magick/blob.c, UnmapBlob frees blob_info->data but does not set the pointer to NULL, and the dangling pointer is returned in a later code path, leading to a use-after-free condition [4].

Exploitation

An attacker can exploit this vulnerability by sending a crafted file to be processed by ImageMagick. No special privileges or authentication are required; the attacker only needs to provide a malicious input that triggers the vulnerable code path during image processing.

Impact

Successful exploitation causes a denial of service, as the use-after-free can lead to application crash or unexpected behavior.

Mitigation

Upgrade to ImageMagick 7.0.8-42 or later (7.x) or 6.9.10-42 or later (6.x) [1]. No workaround is available; applying the patch is recommended.

References
  1. Comparing 7.0.8-41...7.0.8-42 · ImageMagick/ImageMagick
  2. Use after free in magick/blob.c

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

17

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The UnmapBlob function in ImageMagick does not properly set the data pointer to NULL after unmapping, leading to a use-after-free vulnerability."

Attack vector

An attacker can trigger this vulnerability by providing a specially crafted file to ImageMagick. When the UnmapBlob function is called, it attempts to unmap the blob data. However, because the data pointer is not reset, subsequent operations on the blob_info structure can lead to a use-after-free condition, resulting in a denial of service.

Affected code

The vulnerability exists in the `UnmapBlob` function within `MagickCore/blob.c` (or `magick/blob.c` in older versions). The specific lines affected are around line 999 in `MagickCore/blob.c` and line 703 in `magick/blob.c`, where the `blob_info->data` pointer is not reset after being unmapped.

What the fix does

The patch addresses the use-after-free vulnerability by adding the line `blob_info->data=NULL;` within the `if (blob_info->mapped != MagickFalse)` block in the UnmapBlob function. This ensures that after the blob data is unmapped and its resource is relinquished, the data pointer is explicitly set to NULL, preventing any subsequent attempts to access freed memory.

Preconditions

  • inputThe attacker must provide a crafted file that triggers the UnmapBlob function.

Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.