CVE-2020-27753CWE-401

There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file

published December 8, 2020

CVSS
—
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could potentially lead to an impact to application availability or cause a denial of service. It was originally reported that the issues were in `AcquireMagickMemory()` because that is where LeakSanitizer detected the leaks, but the patch resolves issues in the MIFF coder, which incorrectly handles data being passed to `AcquireMagickMemory()`. This flaw affects ImageMagick versions prior to 7.0.9-0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00862 · 58.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2020-12-08T21:57Z
EPSS history
Timeline
  • 08 DEC 21:57Z
    There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file
    cvelistv5