ImageMagick has memory leak in msl encoder

Vulnerability

Overview A memory leak vulnerability exists in ImageMagick's MSL encoder, specifically in the WriteMSLImage function within coders/msl.c [2][4]. When processing MSL (Magick Scripting Language) files, resources are allocated but the function can return early without releasing those resources, leading to memory leaks [2][4].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted MSL file to an application that uses ImageMagick for image processing [1]. No authentication is required if the attacker can supply the input, making the attack surface broad across web services, image upload functions, and other image processing pipelines that use ImageMagick [1][2].

Impact

Repeated exploitation can cause progressive memory consumption, potentially leading to denial of service (DoS) as memory is exhausted [2]. The vulnerability affects all versions prior to 7.1.2-15 and 6.9.13-40 [2][4].

Mitigation

The issue has been patched in ImageMagick versions 7.1.2-15 and 6.9.13-40 [2][4]. Users should upgrade to these or later versions. The patch ensures that allocated resources are properly released on all code paths in WriteMSLImage [4].