CVE-2017-13144

What it actually does

The mpc image coder in ImageMagick fails to validate image dimensions before allocation, resulting in an unhandled crash instead of returning a proper width/height limit error when dimensions exceed internal limits.

Why it matters to the business

Applications that process user-supplied images can be forced offline or into repeated restarts, disrupting services that rely on ImageMagick for format conversion or thumbnail generation.

How an attack unfolds

An attacker crafts a small MPC file header declaring extremely large width and height values, then supplies it to any ImageMagick-based workflow; the library attempts to process the dimensions and crashes rather than gracefully rejecting the input.

How to fix it

Upgrade ImageMagick to version 6.9.7-10 or newer; rebuild any dependent packages against the patched library; consider disabling the mpc coder in policy.xml if immediate upgrade is not feasible.

How to confirm the fix worked

Run identify or convert against a test MPC file with dimensions exceeding 100000x100000 and confirm the command exits with a width/height limit error rather than a segmentation fault or abort.

Typical attack path

1. Attacker generates a minimal MPC image file containing oversized dimension fields
2. File is delivered to the target via upload, URL fetch, or email attachment
3. Target application invokes ImageMagick (e.g., convert, identify) on the file
4. Library dereferences invalid allocation sizes and terminates
5. Service becomes unavailable until restarted or until the process pool is exhausted

How to detect it

Search application and system logs for ImageMagick processes terminating abnormally when handling MPC files; look for repeated segfault or abort entries correlated with image upload or conversion timestamps.

• ImageMagick abort on mpc coder
• width or height exceeds limit
• convert: abort due to signal
• identify: magick/constitute.c

What your security team should do

• Prioritize upgrade of all ImageMagick installations to 6.9.7-10 or later within standard change windows
• Add the oversized-dimension MPC test case to automated regression suites for image-processing pipelines
• Review and tighten ImageMagick security policy to limit resource usage and disable unused coders
• Monitor process crash rates for ImageMagick binaries in production logs