GHSA-m938-565c-h9qf: ImageMagick before 7.1.2-33 Memory Leak in magick compare
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that run the ImageMagick magick compare command on attacker-controlled inputs are exposed. An attacker must be able to provide inputs that cause compare operations to fail repeatedly.
Does exploitation require authentication or user interaction?
The provided vector indicates no privileges are required, but user interaction is required. Exploitation also has high attack complexity and requires a local attack vector.
What is the impact of successful exploitation?
Repeated failed compare operations can exhaust memory and cause a denial of service. The provided impact data indicates availability impact is limited, with no stated confidentiality or integrity impact.
What should be done if patching cannot happen immediately?
Limit untrusted input to workflows that invoke magick compare, and prevent repeated failed compare operations where possible. Monitor memory consumption for compare workloads and stop or restart affected processes if memory use grows unexpectedly.