Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-7397: ImageMagick and GraphicsMagick Memory Leaks in PDF Export

CVE-2019-7397 · published 7 years ago

Summary

ImageMagick and GraphicsMagick have memory leaks when exporting images to PDF. This means that the software may use up more and more memory over time, potentially slowing down or crashing. To protect against this, update to the latest version of ImageMagick or GraphicsMagick.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
imagemagick	imagemagick	< 6.9.10-25 >= 7.0.0-0, < 7.0.8-25 `cpe:2.3:a:imagemagick:imagemagick::::::::`
graphicsmagick	graphicsmagick	<= 1.3.31 `cpe:2.3:a:graphicsmagick:graphicsmagick::::::::`
opensuse	leap	15.0 `cpe:2.3:o:opensuse:leap:15.0:::::::*`
debian	debian_linux	10.0 `cpe:2.3:o:debian:debian_linux:10.0:::::::*`
canonical	ubuntu_linux	16.04 18.04 18.10 19.04 `cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::`

Original advisory text

In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.

References

http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/11ad3aeb8ab1 Patch Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html Broken Link Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html Broken Link
http://www.securityfocus.com/bid/106847 Third Party Advisory VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/306c1f0fa5754ca78efd16ab752f0e... Patch Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1454 Exploit Patch Third Party Advisory
https://usn.ubuntu.com/4034-1/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4712 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

4% chance of attack within 30 days

Type

CWE-401Memory Leak

Timeline

Published5 Feb 2019

Updated30 Oct 2026

First seen7 Aug 2026

Sources

CVE-2019-7397 · OSV

CVE-2019-7397 · NVD

Track software like this

Free during beta