Technical impact
ImageMagick versions prior to 6.9.13‑58 and 7.x earlier than 7.1.2‑33 contain a memory leak when the -cdl (color decision list) option is processed. The bug prevents the deallocation of memory that was allocated for the color decision list, which is a classic instance of CWE‑401 and CWE‑772. An attacker can cause the option to be invoked by supplying crafted image data or command‑line parameters, leading to progressive consumption of system memory and eventual service degradation or crash.
Affected Systems
Any system that has ImageMagick 6.x versions older than 6.9.13‑58 or 7.x versions older than 7.1.2‑33 is affected. This includes common Linux distributions, web and media servers, and standalone image‑processing utilities that use the default ImageMagick binaries.
Risk and Exploitability
The CVSS score of 4.8 indicates a moderate severity vulnerability. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. However, the flaw can be triggered remotely if an attacker can submit image data or command‑line arguments that enable the -cdl option, or locally if the software processes untrusted input. Repeated exploitation can lead to denial‑of‑service by exhausting system memory.
Debian DLA