3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2gq3-ww97-wfjm

GHSA-2gq3-ww97-wfjm: ImageMagick has a possible heap Use After Free vulnerability in its meta coder

A heap Use After Free vulnerability exists in the meta coder when an allocation fails and a single byte is written to a stale pointer.

==535852==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000088ff at pc 0x5581bacac14d bp 0x7ffdf667edf0 sp 0x7ffdf667ede0
WRITE of size 1 at 0x5210000088ff thread T0

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2gq3-ww97-wfjm

GHSA-2gq3-ww97-wfjm:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x86	nuget	< 14.10.3	14.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a heap-use-after-free in the meta coder of ImageMagick. The analysis of the patch commit f5049954f12c6fcf090a776767526d2a4708d58b reveals that the vulnerability exists in two static functions within coders/meta.c: super_fgets and super_fgets_w. These functions are responsible for reading data from a META file into a buffer. When the buffer needs to be enlarged to accommodate more data, the code attempts to reallocate it. If this reallocation fails (e.g., due to memory exhaustion which can be triggered by a crafted file), the vulnerable version of the code frees the original buffer. However, it then proceeds to write a null terminator to a pointer that is an offset within that just-freed buffer. This action constitutes a use-after-free, which can lead to a crash or potentially arbitrary code execution. The patch mitigates this by removing the call that frees the memory (RelinquishMagickMemory) and instead sets the main pointer to NULL before breaking out of the processing loop. This prevents the write to the freed memory block, though it intentionally introduces a memory leak in this specific error condition to fix the more severe security vulnerability.

Vulnerable functions

super_fgets

coders/meta.c

The vulnerability occurs when reading a crafted file. The `super_fgets` function reads data into a buffer. If the buffer is too small, it is resized using `ResizeQuantumMemory`. If this reallocation fails, the original code would free the memory using `RelinquishMagickMemory` but would later attempt to write a null terminator to a pointer (`q`) that is an offset from the now-freed memory, leading to a heap-use-after-free. The patch fixes this by setting the pointer `p` to NULL and breaking the loop, thus preventing the write to freed memory, although this introduces a memory leak.

super_fgets_w

coders/meta.c

Similar to `super_fgets`, this function for wide characters has the same flaw. When `ResizeQuantumMemory` fails during buffer resizing, the original code would free the memory but still attempt to write to it. The patch applies the same fix as in `super_fgets` by setting the pointer to NULL to prevent the use-after-free.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.