Listen to this Post
How the mentioned CVE works:
In ImageMagick’s Magick++ layer, invoking Options::fontFamily with an empty string triggers a cleanup that calls RelinquishMagickMemory on _drawInfo->font, freeing the font string memory. However, _drawInfo->font remains a dangling pointer, and _drawInfo->family is set to this invalid pointer. Subsequent operations like DestroyDrawInfo or setters (Options::font, Image::font) assume _drawInfo->font is valid, leading to re-freeing or dereferencing of freed memory. This use-after-free causes heap corruption or crashes, potentially allowing arbitrary code execution. Fixed versions properly nullify pointers after freeing.
Platform: ImageMagick
Version: Prior to 7.1.2-9
Vulnerability: Use-After-Free
Severity: Critical
Date: 12/02/2025
Prediction: Patched in 7.1.2-9
What Undercode Say:
Analytics:
- Check version: `convert –version`
– Vulnerable code snippet: `options.fontFamily(“”);`
How Exploit:
- Craft empty fontFamily calls.
- Trigger use-after-free repeatedly.
- Corrupt heap for execution.
Protection from this CVE:
- Update ImageMagick immediately.
- Avoid empty fontFamily strings.
- Apply security patches.
Impact:
- Application crashes.
- Heap corruption.
- Possible code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
