GHSA-c2qq-jqw7-q4mx: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected. Deployments using either older release line should be evaluated.
What must an attacker be able to do to exploit this issue?
An attacker must be able to supply input that causes ImageMagick to process the -cdl color decision list option. Repeated processing can leak memory and degrade availability through resource exhaustion.
Is user interaction required?
Yes. The supplied severity vector indicates user interaction is required, meaning exploitation depends on a user processing attacker-supplied input rather than occurring solely through an unauthenticated remote request.
What is the impact of successful exploitation?
The documented impact is availability degradation from memory exhaustion. The severity vector indicates no stated impact to confidentiality or integrity.