GHSA-5jf2-9gcp-q234: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they process images containing XMP profiles through vulnerable decoders.
What does an attacker need to exploit the vulnerability?
An attacker needs to cause the affected ImageMagick deployment to process an image containing a crafted XMP profile. No authentication or user interaction is required according to the supplied severity vector.
What is the impact of repeated exploitation?
Each processing event can leak memory. Repeated processing of crafted images can exhaust available resources and cause a denial of service.
How can the issue be remediated?
Upgrade ImageMagick to version 6.9.13-58 or later, or to version 7.1.2-33 or later.