{"id":"JLSEC-2026-917","summary":"ImageMagick has a Memory Leak in magick stream","details":"## Summary\n\nIn ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak.\n\n## Details\n\n  - **Vulnerability Type:** Memory leak\n  - **Affected Version:** ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025)\n\n## Reproduction\n\n### Tested Environment\n\n  - **Operating System:** Ubuntu 22.04 LTS\n  - **Architecture:** x86_64\n  - **Compiler:** gcc with AddressSanitizer (gcc version: 11.4.0)\n\n### Reproduction Steps\n\n```bash\n# Clone source\ngit clone --depth 1 --branch 7.1.1-47 https://github.com/ImageMagick/ImageMagick.git ImageMagick-7.1.1\ncd ImageMagick-7.1.1\n\n# Build with ASan\nCFLAGS=\"-g -O0 -fsanitize=address -fno-omit-frame-pointer\" CXXFLAGS=\"$CFLAGS\" LDFLAGS=\"-fsanitize=address\" ./configure --enable-maintainer-mode --enable-shared && make -j$(nproc) && make install\n\n# Trigger crash\n./utilities/magick stream %d%d a a\n```\n\n### Output\n\n```\n$ magick stream %d%d a a\nstream: no decode delegate for this image format `' @ error/constitute.c/ReadImage/746.\nstream: missing an image filename `a' @ error/stream.c/StreamImageCommand/755.\n\n=================================================================\n==114==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 152 byte(s) in 1 object(s) allocated from:\n    #0 0x7fc4ebe58887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145\n    #1 0x7fc4eb563c5c in AcquireMagickMemory MagickCore/memory.c:559\n    #2 0x7fc4eb563c82 in AcquireCriticalMemory MagickCore/memory.c:635\n    #3 0x7fc4eb60c2be in AcquireQuantumInfo MagickCore/quantum.c:119\n    #4 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335\n    #5 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292\n    #6 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177\n    #7 0x55a34f7c0a0c in MagickMain utilities/magick.c:153\n    #8 0x55a34f7c0cba in main utilities/magick.c:184\n    #9 0x7fc4ea38fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n\nIndirect leak of 64 byte(s) in 1 object(s) allocated from:\n    #0 0x7fc4ebe5957c in __interceptor_posix_memalign ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:226\n    #1 0x7fc4eb680e2f in AcquireSemaphoreMemory MagickCore/semaphore.c:154\n    #2 0x7fc4eb680f30 in AcquireSemaphoreInfo MagickCore/semaphore.c:200\n    #3 0x7fc4eb60d38d in GetQuantumInfo MagickCore/quantum.c:435\n    #4 0x7fc4eb60c30e in AcquireQuantumInfo MagickCore/quantum.c:121\n    #5 0x7fc4eb6b6621 in StreamImage MagickCore/stream.c:1335\n    #6 0x7fc4eb09d889 in StreamImageCommand MagickWand/stream.c:292\n    #7 0x7fc4eaf1295d in MagickCommandGenesis MagickWand/magick-cli.c:177\n    #8 0x55a34f7c0a0c in MagickMain utilities/magick.c:153\n    #9 0x55a34f7c0cba in main utilities/magick.c:184\n    #10 0x7fc4ea38fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\n\nSUMMARY: AddressSanitizer: 216 byte(s) leaked in 2 allocation(s).\n```\n\n### Commits\n\nFixed in https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c and https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b","modified":"2026-07-30T18:35:32.312172688Z","published":"2026-07-30T16:02:27.435Z","upstream":["CVE-2025-53019","EUVD-2025-21390","GHSA-cfh4-9f7v-fhrc"],"database_specific":{"license":"CC-BY-4.0","sources":[{"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-53019","html_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019","database_specific":{"status":"Modified"},"id":"CVE-2025-53019","imported":"2026-07-30T14:08:44.093Z","modified":"2026-06-17T09:37:29.113Z","published":"2025-07-14T20:15:29.043Z"},{"imported":"2026-07-30T14:09:52.917Z","modified":"2025-11-03T22:59:46Z","published":"2025-08-25T15:53:57Z","url":"https://api.github.com/advisories/GHSA-cfh4-9f7v-fhrc","html_url":"https://github.com/advisories/GHSA-cfh4-9f7v-fhrc","id":"GHSA-cfh4-9f7v-fhrc"},{"modified":"2025-11-03T18:13:10Z","published":"2025-07-14T19:42:49Z","url":"https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2025-21390","html_url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21390","id":"EUVD-2025-21390","imported":"2026-07-30T14:08:55.880Z"}]},"references":[{"type":"WEB","url":"https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c"},{"type":"WEB","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc"},{"type":"WEB","url":"https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b"},{"type":"WEB","url":"https://github.com/advisories/GHSA-cfh4-9f7v-fhrc"},{"type":"WEB","url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53019"}],"affected":[{"package":{"name":"ImageMagick_jll","ecosystem":"Julia","purl":"pkg:julia/ImageMagick_jll?uuid=c73af94c-d91f-53ed-93a7-00f77d67a9d7"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.2001+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-917.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"credits":[{"name":"YutoIn","contact":["https://github.com/YutoIn"],"type":"FINDER"},{"name":"iwashiira","contact":["https://github.com/iwashiira"],"type":"FINDER"},{"name":"momo-trip","contact":["https://github.com/momo-trip"],"type":"FINDER"},{"name":"utshina","contact":["https://github.com/utshina"],"type":"FINDER"}]}