ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Vulnerability

Details

ImageMagick [1] is a widely used open-source image processing suite. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in its PSD (Adobe Photoshop) format handler [2]. The root cause is that when processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, the code does not initialize the pixel buffer. This results in uninitialized heap memory being leaked into the output image [4].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted PSD file to any application that uses ImageMagick to process images. No authentication is required if the application accepts user-uploaded images. The attack vector is local or remote, depending on how ImageMagick is integrated. The only prerequisite is that the application processes PSD files using an affected version of ImageMagick.

Impact

Successful exploitation leads to information disclosure of heap memory contents. This could expose sensitive data such as cryptographic keys, passwords, or other confidential information that resides in the heap of the ImageMagick process or other processes sharing memory. The severity is moderate, as it requires a crafted file and does not directly allow code execution.

Mitigation

The vulnerability has been patched in ImageMagick versions 7.1.2-15 and 6.9.13-40 [2]. The fix, as shown in commit 51c9d33, initializes the pixel buffer with zeros before reading compressed data [4]. Users should update to the latest version. As a workaround, administrators can disable PSD support in ImageMagick's policy.xml if not required.