ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family

Vulnerability

Analysis

ImageMagick, a widely used open-source image processing suite, contains a use-after-free vulnerability in its Magick++ C++ API layer. The bug is triggered when the Options::fontFamily() method is called with an empty string to clear the font family. The code calls RelinquishMagickMemory on _drawInfo->font, freeing the memory, but then sets _drawInfo->family to point to that freed memory [1]. This leaves a dangling pointer in _drawInfo->font, which is not properly invalidated. Any subsequent use of _drawInfo->font—such as during DestroyDrawInfo cleanup or when setting a new font—becomes a use-after-free operation. The error was present in ImageMagick versions prior to 7.1.2-9 and 6.9.13-34 [1][3].

Exploitation

Exploitation requires calling the fontFamily setter with an empty string, which is a legitimate API operation. No special authentication is needed; the attacker must only convince an application using the affected Magick++ library to invoke this function—commonly by crafting an image or input that triggers font clearing. Once the dangling pointer is created, any subsequent operation that accesses or frees _drawInfo->font can trigger a crash. The vulnerability does not require network access if the application processes untrusted local files, but remote exploitation is possible if the application accepts user-supplied images over a network protocol.

Impact

An attacker can cause a denial-of-service via application crash or potentially achieve heap corruption, which may lead to more severe consequences depending on memory layout and subsequent operations. The corruption occurs because the freed memory may be reused by other allocations, and a double-free or use-after-free can destabilize the heap [1]. While the official advisory does not confirm remote code execution, heap corruption in a C++ application is a known vector for arbitrary code execution under favorable conditions.

Mitigation

The vulnerability is fixed in ImageMagick versions 7.1.2-9 and 6.9.13-34 [1][3]. Users of ImageMagick should upgrade to the patched versions immediately. No workaround other than avoiding the use of the fontFamily setter with an empty string is known, but such a workaround is impractical in many applications. This flaw does not appear on CISA's Known Exploited Vulnerabilities catalog as of the publication date.