ImageMagick: Invalid MSL <map> can result in a use after free

Vulnerability

Overview

A use-after-free vulnerability exists in the MSL interpreter of ImageMagick, a widely used open-source image processing suite. The bug occurs when the interpreter processes a specially crafted, invalid `` element, causing it to access an image object after it has already been freed from memory [1][2]. This flaw affects all versions prior to 7.1.2-15 and 6.9.13-40 [2].

Exploitation and

Attack Surface

An attacker can exploit this vulnerability by supplying a malicious MSL file that contains an invalid `` element. The attack does not require authentication, as ImageMagick is often used in server-side processing pipelines that accept user-uploaded images [1]. The MSL interpreter's handling of the malformed element triggers the use-after-free condition, which can be leveraged to corrupt memory [4].

Impact

Successful exploitation could lead to a denial of service (crash) or, in more severe scenarios, arbitrary code execution in the context of the ImageMagick process. The CVSS vector indicates a high severity, with potential impacts on confidentiality, integrity, and availability [4].

Mitigation

The vulnerability has been patched in ImageMagick versions 7.1.2-15 and 6.9.13-40 [2]. Users are strongly advised to update to these or later versions. As a workaround, administrators can restrict the use of the MSL format through a security policy, though updating is the recommended course of action [1][4].