What is CVE-2017-18272?

CVE-2017-18272 is a medium-severity vulnerability in Imagemagick, classified under Use After Free. CVSS score: 6.5/10. Published 2018-05-18.

How severe is CVE-2017-18272?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Use After Free in Imagemagick

CVE-2017-18272

In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is mishandled in an MngInfoDiscardObject call.

Vulnerability class: Use-After-Free

EPSS: 0.012 (65.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Affected products

Imagemagick
N/a — versions n/a

Weakness classification (CWE)

CWE-416 — Use After Free

References

cve@mitre.org (x_refsource_CONFIRM, Exploit, Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2017-18272?: CVE-2017-18272 is a medium-severity vulnerability in Imagemagick, classified under Use After Free. CVSS score: 6.5/10. Published 2018-05-18.
How severe is CVE-2017-18272?: Medium severity. CVSS v3 base score is 6.5 out of 10.