CVE-2019-17547

Vulnerability

A use-after-free vulnerability exists in the TraceBezier function in MagickCore/draw.c of ImageMagick before version 7.0.8-62 [2]. The bug occurs because the pointer primitive_info is dereferenced after it is reassigned to (*mvg_info->primitive_info)+mvg_info->offset, but a prior AcquireQuantumMemory call could fail and free the underlying memory, leaving the pointer dangling [2]. The fixed version addresses this by re-ordering operations to ensure primitive_info is only used after the memory allocation check [2].

Exploitation

An attacker would need to supply a crafted input file (e.g., an SVG or MVG image) that triggers the vulnerable code path in TraceBezier [1]. No special network position is required; exploitation can occur when a user or automated service processes the malicious image using the vulnerable ImageMagick version [1]. The attack likely requires no authentication, as ImageMagick often runs as a background service or is invoked by user processes.

Impact

Successful exploitation could lead to memory corruption, potentially resulting in a denial of service (crash) or arbitrary code execution [1][2]. The impact depends on the attacker's ability to control the freed memory contents after the use-after-free [2]. The vulnerability affects the CIA triad primarily through availability (denial of service) and potentially confidentiality and integrity if code execution is achieved [1].

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.8-62 [1][2]. Users should update to this version or later. No workarounds are available; however, users can mitigate risk by ensuring that ImageMagick processes only trusted image files. This CVE is not listed on the CISA KEV catalog.