PT-2026-76309 · Julia · Imagemagick Jll

Published

2026-07-30

·

Updated

2026-07-30

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

In ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak.

Details

  • Vulnerability Type: Memory leak
  • Affected Version: ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025)

Reproduction

Tested Environment

  • Operating System: Ubuntu 22.04 LTS
  • Architecture: x86 64
  • Compiler: gcc with AddressSanitizer (gcc version: 11.4.0)

Reproduction Steps

bash
# Clone source
git clone --depth 1 --branch 7.1.1-47 https://github.com/ImageMagick/ImageMagick.git ImageMagick-7.1.1
cd ImageMagick-7.1.1

# Build with ASan
CFLAGS="-g -O0 -fsanitize=address -fno-omit-frame-pointer" CXXFLAGS="$CFLAGS" LDFLAGS="-fsanitize=address" ./configure --enable-maintainer-mode --enable-shared && make -j$(nproc) && make install

# Trigger crash
./utilities/magick stream %d%d a a

Output

$ magick stream %d%d a a
stream: no decode delegate for this image format `' @ error/constitute.c/ReadImage/746.
stream: missing an image filename `a' @ error/stream.c/StreamImageCommand/755.

=================================================================
==114==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 152 byte(s) in 1 object(s) allocated from:
  #0 0x7fc4ebe58887 in  interceptor malloc ../../../../src/libsanitizer/asan/asan malloc linux.cpp:145
  #1 0x7fc4eb563c5c in AcquireMagickMemory MagickCore/memory.c:559
  #2 0x7fc4eb563c82 in AcquireCriticalMemory MagickCore/memory.c:635
  #3 0x7fc4eb60c2be in AcquireQuantumInfo MagickCore/quantum.c:119
  #4 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335
  #5 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292
  #6 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177
  #7 0x55a34f7c0a0c in MagickMain utilities/magick.c:153
  #8 0x55a34f7c0cba in main utilities/magick.c:184
  #9 0x7fc4ea38fd8f in  libc start call main ../sysdeps/nptl/libc start call main.h:58

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
  #0 0x7fc4ebe5957c in  interceptor posix memalign ../../../../src/libsanitizer/asan/asan malloc linux.cpp:226
  #1 0x7fc4eb680e2f in AcquireSemaphoreMemory MagickCore/semaphore.c:154
  #2 0x7fc4eb680f30 in AcquireSemaphoreInfo MagickCore/semaphore.c:200
  #3 0x7fc4eb60d38d in GetQuantumInfo MagickCore/quantum.c:435
  #4 0x7fc4eb60c30e in AcquireQuantumInfo MagickCore/quantum.c:121
  #5 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335
  #6 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292
  #7 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177
  #8 0x55a34f7c0a0c in MagickMain utilities/magick.c:153
  #9 0x55a34f7c0cba in main utilities/magick.c:184
  #10 0x7fc4ea38fd8f in  libc start call main ../sysdeps/nptl/libc start call main.h:58

SUMMARY: AddressSanitizer: 216 byte(s) leaked in 2 allocation(s).

Commits

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

JLSEC-2026-917

Affected Products

Imagemagick Jll