ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTree

Root

Cause

In ImageMagick versions prior to 6.9.13-27 and 7.1.2-1, the CloneSplayTree function uses a callback with an incorrect function signature, leading to undefined behavior classified as a function-type-mismatch [1][2]. This flaw exists in the splay tree implementation within MagickCore/splay-tree.c [3].

Attack

Vector

The vulnerability is triggered by processing a minimal, specially crafted 2-byte input through MagickWand's coalesce operation [3]. No authentication is required, as ImageMagick often processes user-supplied images in web services or desktop applications. The attack surface is limited to sanitizer-enabled builds (e.g., those compiled with UndefinedBehaviorSanitizer), where the mismatch is detected and causes a deterministic abort [2][3]. In non-sanitized builds, the code executes without visible crash [2].

Impact

Under UBSan, an attacker can cause a denial-of-service (DoS) condition by providing the malicious 2-byte input, which will abort the process [2][3]. The advisory notes that the security impact is likely low in production environments because typical builds do not use sanitizers, and no crash occurs without them [2][3].

Mitigation

The issue has been patched in ImageMagick versions 6.9.13-27 and 7.1.2-1 [1][2]. Users should update to these versions or later. The .NET binding Magick.NET has also released version 14.8.0 which includes this fix [4].