ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

Vulnerability

Overview

A NULL pointer dereference vulnerability exists in the ClonePixelCacheRepository function of ImageMagick, a widely used open-source image processing suite. The root cause lies in the CloneImage function within MagickCore/image.c: when an image has zero columns or rows, CloneImage returns NULL after throwing a CorruptImageError exception. However, the calling function in MagickCore/transform.c (TransformImage) does not check for this NULL return before dereferencing the pointer, leading to a crash [1].

Exploitation

To exploit this vulnerability, a remote attacker only needs to supply a crafted image file that causes image->columns or image->rows to be zero. Any application or service linked against ImageMagick that processes user-supplied images is vulnerable. No authentication is required, and the attack can be triggered simply by the application attempting to transform or clone the malicious image [1][3].

Impact

Successful exploitation results in a denial of service (DoS) as the application or service crashes due to the NULL pointer dereference. This can disrupt operations for web applications, graphic design tools, and other systems relying on ImageMagick for image processing [1][3].

Mitigation

The vulnerability is patched in ImageMagick versions 7.1.2-15 and 6.9.13-40. Users should update to these patched versions immediately. No workarounds are documented, but following security best practices such as validating image dimensions before processing can help mitigate the risk [1][3].