Technical impact
The vulnerability is a memory leak in the TIFF encoder of ImageMagick that occurs when an invalid tiff:tile-geometry value is supplied. The fault arises from missing resource release (CWE-401) and improper handling of allocated memory (CWE-772), causing memory to remain allocated and never be freed. The effect is increased memory consumption without providing code execution or privilege escalation. At its worst, the leak can lead to a denial of service if an attacker continuously feeds malformed TIFFs.
Affected Systems
Both major branches of ImageMagick are impacted. Versions before 7.1.2-26 and before 6.9.13-51, to which the vulnerability applies, are distributed under the ImageMagick umbrella.
Risk and Exploitability
The CVSS score of 2 signals low severity, and the EPSS score of less than 1% indicates that exploitation is unlikely but not impossible. Based on the description, the likely attack vector involves an attacker providing a malformed TIFF with an invalid tiff:tile-geometry to a process that runs ImageMagick. If the application processes external images, the threat may be limited to users with local or elevated privileges. Overall, the risk level remains low, though repeated exploitation could cause memory exhaustion. The vulnerability is not listed in the CISA KEV catalog.
Debian DLA