CVE-2017-6497 Imagemagick CVE debrief

Who should care

Administrators and developers running ImageMagick 6.9.7, especially in services that accept or process user-supplied PSD files or other untrusted images. Security teams supporting file upload pipelines, image conversion services, and document processing systems should review exposure promptly.

Technical summary

The vulnerability is a NULL pointer dereference in ImageMagick 6.9.7 associated with parsing a specially crafted PSD file. The documented impact is denial of service only: confidentiality and integrity are not affected in the provided CVSS vector, while availability is high. The CVE record and NVD both point to an upstream ImageMagick patch commit as the remediation reference.

Defensive priority

High for any environment that processes untrusted image uploads or automated image conversions; otherwise moderate. Because the issue is remotely reachable in the CVSS vector and can cause service interruption, exposed parsing endpoints should be prioritized for patching.

Recommended defensive actions

• Upgrade ImageMagick to a version that includes the upstream fix referenced by the ImageMagick patch commit.
• Treat PSD and other user-controlled image inputs as untrusted and isolate image-processing services where feasible.
• Review upload and conversion workflows for exposure to crafted image files, especially where ImageMagick is invoked automatically.
• If immediate upgrading is not possible, reduce exposure by restricting which file types can reach ImageMagick and by placing processing behind strict validation and sandboxing controls.
• Verify remediation against the upstream patch reference and confirm the affected 6.9.7 build is no longer deployed.

Evidence notes

The CVE description states that an issue was discovered in ImageMagick 6.9.7 and that a specially crafted PSD file can lead to a NULL pointer dereference causing DoS. NVD assigns CWE-476 and CVSS 3.0 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The supplied references include the CVE record, the NVD detail page, a Debian bug tracker entry, and an ImageMagick patch commit.

Official resources