GHSA-pj4h-g4pf-66v3: ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using PerlMagick with ImageMagick versions before 7.1.2-33 are exposed. The issue is triggered when image properties are read through one of five affected PerlMagick code locations.
What does exploitation require and what is the practical impact?
An attacker must be able to repeatedly cause affected PerlMagick property-read operations. Repeated reads leak memory and can exhaust available memory, resulting in denial of service.
How can I determine whether I am affected?
Check whether your application uses the PerlMagick interface and runs an ImageMagick version earlier than 7.1.2-33. Applications that do not use PerlMagick property-reading operations are not identified in the available data as affected.