CVE-2019-16708

Vulnerability

ImageMagick version 7.0.8-35 contains a memory leak in the magick/xwindow.c file, specifically in the XCreateImage function [1]. The leak occurs when the convert command writes an image to an X11 output format (e.g., output.x). The code path involves XMakeImage, XConfigureImage, and XDisplayImage, which allocate memory that is not properly freed, resulting in a cumulative memory leak of 48136 bytes per operation [1].

Exploitation

An attacker can trigger the memory leak by providing a crafted image file and running the ImageMagick convert command with an X11 output target (e.g., magick convert input output.x) [1]. No authentication or special privileges are required; the attacker only needs to convince a user to process a malicious image file. The leak is reproducible on Linux systems and does not require any race condition or user interaction beyond executing the command [1].

Impact

Successful exploitation leads to a memory leak that can exhaust system resources over repeated invocations, potentially causing a denial-of-service condition [1]. The leak is per-operation, so an attacker who can repeatedly trigger the conversion can degrade system performance or cause the application to crash due to memory exhaustion.

Mitigation

As of the publication date (2019-09-23), no official patch has been released for this issue [1]. Users are advised to avoid using X11 output formats (e.g., .x) if not necessary, or to monitor the ImageMagick project for updates that address the memory leak. Upgrading to a version newer than 7.0.8-35 may include a fix, but the reference does not specify a fixed version [1].