ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML
Date: 2026-01
Affected: nuget/Magick.NET-Q16-HDRI-AnyCPU, nuget/Magick.NET-Q16-AnyCPU, nuget/Magick.NET-Q8-AnyCPU
Attack vector: dos
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-763
CVSS: 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)

### Summary A memory leak vulnerability exists in the `LoadOpenCLDeviceBenchmark()` function in `MagickCore/opencl.c`. When parsing a malformed OpenCL device profile XML file that contains `<device` elements without proper `/>` closing tags, the function fails to release allocated memory for string members (`platform_name`, `vendor_name`, `name`, `version`), leading to memory leaks that could result in resource exhaustion. **Affected Version**: ImageMagick 7.1.2-12 and possibly earlier versions --- ### Details The vulnerability is located in `MagickCore/opencl.c`, function `LoadOpenCLDeviceBenchmark()` (lines 754-911). **Root Cause Analysis:** 1. When a `<device` tag is encountered, a `MagickCLDeviceBenchmark` structure is allocated (line 807-812) 2. String attributes (`platform`, `vendor`, `name`, `version`) are allocated via `ConstantString()` (lines 878, 885, 898, 900) 3. These strings are **only freed** when a `/>` closing tag is encountered (lines 840-849) 4. At function exit (lines 908-910), only the `device_benchmark` structure is freed, but **its member variables are not freed** if `/>` was never parsed **Vulnerable Code (lines 908-910):** ```c token=(char *) RelinquishMagickMemory(token); device_benchmark=(MagickCLDeviceBenchmark *) RelinquishMagickMemory( device_benchmark); // BUG: members (platform_name, vendor_name, name, version) not freed! ``` **Correct cleanup (only executed when `/>` is found, lines 840-849):** ```c device_benchmark->platform_nam


Mitigations:

Architectural layers (MAESTRO):