ghsa-cfh4-9f7v-fhrc
Vulnerability from github
Summary
In ImageMagick's magick stream
command, specifying multiple consecutive %d
format specifiers in a filename template causes a memory leak.
Details
- Vulnerability Type: Memory leak
- Affected Version: ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025)
Reproduction
Tested Environment
- Operating System: Ubuntu 22.04 LTS
- Architecture: x86_64
- Compiler: gcc with AddressSanitizer (gcc version: 11.4.0)
Reproduction Steps
```bash
Clone source
git clone --depth 1 --branch 7.1.1-47 https://github.com/ImageMagick/ImageMagick.git ImageMagick-7.1.1 cd ImageMagick-7.1.1
Build with ASan
CFLAGS="-g -O0 -fsanitize=address -fno-omit-frame-pointer" CXXFLAGS="$CFLAGS" LDFLAGS="-fsanitize=address" ./configure --enable-maintainer-mode --enable-shared && make -j$(nproc) && make install
Trigger crash
./utilities/magick stream %d%d a a ```
Output
``
$ magick stream %d%d a a
stream: no decode delegate for this image format
' @ error/constitute.c/ReadImage/746.
stream: missing an image filename `a' @ error/stream.c/StreamImageCommand/755.
================================================================= ==114==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 152 byte(s) in 1 object(s) allocated from: #0 0x7fc4ebe58887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x7fc4eb563c5c in AcquireMagickMemory MagickCore/memory.c:559 #2 0x7fc4eb563c82 in AcquireCriticalMemory MagickCore/memory.c:635 #3 0x7fc4eb60c2be in AcquireQuantumInfo MagickCore/quantum.c:119 #4 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335 #5 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292 #6 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177 #7 0x55a34f7c0a0c in MagickMain utilities/magick.c:153 #8 0x55a34f7c0cba in main utilities/magick.c:184 #9 0x7fc4ea38fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
Indirect leak of 64 byte(s) in 1 object(s) allocated from: #0 0x7fc4ebe5957c in __interceptor_posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:226 #1 0x7fc4eb680e2f in AcquireSemaphoreMemory MagickCore/semaphore.c:154 #2 0x7fc4eb680f30 in AcquireSemaphoreInfo MagickCore/semaphore.c:200 #3 0x7fc4eb60d38d in GetQuantumInfo MagickCore/quantum.c:435 #4 0x7fc4eb60c30e in AcquireQuantumInfo MagickCore/quantum.c:121 #5 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335 #6 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292 #7 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177 #8 0x55a34f7c0a0c in MagickMain utilities/magick.c:153 #9 0x55a34f7c0cba in main utilities/magick.c:184 #10 0x7fc4ea38fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
SUMMARY: AddressSanitizer: 216 byte(s) leaked in 2 allocation(s). ```
Commits
Fixed in https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c and https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b
{ "affected": [ { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-AnyCPU" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-HDRI-AnyCPU" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-HDRI-OpenMP-arm64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-HDRI-OpenMP-x64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-HDRI-arm64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-HDRI-x64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-HDRI-x86" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-OpenMP-arm64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-OpenMP-x64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-arm64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-x64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q16-x86" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q8-AnyCPU" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q8-OpenMP-arm64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q8-OpenMP-x64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q8-arm64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q8-x64" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "NuGet", "name": "Magick.NET-Q8-x86" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "14.7.0" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2025-53019" ], "database_specific": { "cwe_ids": [ "CWE-404" ], "github_reviewed": true, "github_reviewed_at": "2025-08-25T15:53:57Z", "nvd_published_at": "2025-07-14T20:15:29Z", "severity": "LOW" }, "details": "## Summary\n\nIn ImageMagick\u0027s `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak.\n\n## Details\n\n- **Vulnerability Type:** Memory leak\n- **Affected Version:** ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025)\n\n## Reproduction\n\n### Tested Environment\n\n- **Operating System:** Ubuntu 22.04 LTS\n- **Architecture:** x86_64\n- **Compiler:** gcc with AddressSanitizer (gcc version: 11.4.0)\n\n### Reproduction Steps\n\n```bash\n# Clone source\ngit clone --depth 1 --branch 7.1.1-47 https://github.com/ImageMagick/ImageMagick.git ImageMagick-7.1.1\ncd ImageMagick-7.1.1\n\n# Build with ASan\nCFLAGS=\"-g -O0 -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"$CFLAGS\" LDFLAGS=\"-fsanitize=address\" ./configure --enable-maintainer-mode --enable-shared \u0026\u0026 make -j$(nproc) \u0026\u0026 make install\n\n# Trigger crash\n./utilities/magick stream %d%d a a\n```\n\n### Output\n```\n$ magick stream %d%d a a\nstream: no decode delegate for this image format `\u0027 @ error/constitute.c/ReadImage/746.\nstream: missing an image filename `a\u0027 @ error/stream.c/StreamImageCommand/755.\n\n=================================================================\n==114==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 152 byte(s) in 1 object(s) allocated from:\n #0 0x7fc4ebe58887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145\n #1 0x7fc4eb563c5c in AcquireMagickMemory MagickCore/memory.c:559\n #2 0x7fc4eb563c82 in AcquireCriticalMemory MagickCore/memory.c:635\n #3 0x7fc4eb60c2be in AcquireQuantumInfo MagickCore/quantum.c:119\n #4 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335\n #5 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292\n #6 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177\n #7 0x55a34f7c0a0c in MagickMain utilities/magick.c:153\n #8 0x55a34f7c0cba in main utilities/magick.c:184\n #9 0x7fc4ea38fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n\nIndirect leak of 64 byte(s) in 1 object(s) allocated from:\n #0 0x7fc4ebe5957c in __interceptor_posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:226\n #1 0x7fc4eb680e2f in AcquireSemaphoreMemory MagickCore/semaphore.c:154\n #2 0x7fc4eb680f30 in AcquireSemaphoreInfo MagickCore/semaphore.c:200\n #3 0x7fc4eb60d38d in GetQuantumInfo MagickCore/quantum.c:435\n #4 0x7fc4eb60c30e in AcquireQuantumInfo MagickCore/quantum.c:121\n #5 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335\n #6 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292\n #7 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177\n #8 0x55a34f7c0a0c in MagickMain utilities/magick.c:153\n #9 0x55a34f7c0cba in main utilities/magick.c:184\n #10 0x7fc4ea38fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n\nSUMMARY: AddressSanitizer: 216 byte(s) leaked in 2 allocation(s).\n```\n\n### Commits\nFixed in https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c and https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b", "id": "GHSA-cfh4-9f7v-fhrc", "modified": "2025-08-25T15:53:57Z", "published": "2025-08-25T15:53:57Z", "references": [ { "type": "WEB", "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53019" }, { "type": "WEB", "url": "https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c" }, { "type": "WEB", "url": "https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b" }, { "type": "PACKAGE", "url": "https://github.com/ImageMagick/ImageMagick" }, { "type": "WEB", "url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "type": "CVSS_V3" } ], "summary": "ImageMagick has a Memory Leak in magick stream" }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.