N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3q5f-gmjc-38r8

GHSA-3q5f-gmjc-38r8: ImageMagick: Memory leak in coders/txt.c without freetype

If a texture attribute is specified for a TXT file, an attempt will be made to read it via texture=ReadImage(read_info,exception);. Later, when retrieving metrics via the GetTypeMetrics function, if this function fails (i.e., status == MagickFalse), the calling function will exit immediately but fail to release the texture object, leading to memory leakage.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-3q5f-gmjc-38r8

GHSA-3q5f-gmjc-38r8:

N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x86	nuget	< 14.10.3	14.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a memory leak in the TXT image coder (coders/txt.c) of ImageMagick. The provided commit e6394098af39a9689bb5f0b4eb6a9968e449a8d3 directly addresses this issue. The patch modifies the ReadTEXTImage function. Specifically, it adds a call to DestroyImageList(texture) within an error handling block. This block is executed if GetTypeMetrics fails. Before the patch, if GetTypeMetrics failed, the function would throw an exception and return, but it would not release the memory allocated for the texture image that was read earlier in the function. This failure to release memory is the root cause of the memory leak. Therefore, the ReadTEXTImage function is the vulnerable function, as it is responsible for both allocating and, in the failure case, failing to deallocate the memory for the texture image.

Vulnerable functions

ReadTEXTImage

coders/txt.c

The vulnerability lies in the `ReadTEXTImage` function. When processing a TXT file with a 'texture' attribute, an image is read into the 'texture' variable. If the subsequent call to `GetTypeMetrics` fails (indicated by `status == MagickFalse`), the function would previously exit without freeing the memory allocated for the 'texture' image, leading to a memory leak. The patch adds the `texture=DestroyImageList(texture);` call to release this memory before exiting.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.