ANT-2026-F1GCJ0JY · graphicsmagick/graphicsmagick

use-after-free medium

Severity Claude critical · Security research firm medium · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-F1GCJ0JY: Use-after-free in miff.c:1048

GraphicsMagick's MIFF image reader allocates a buffer at coders/miff.c:1011 and later attempts to grow it via realloc at miff.c:1034. When the realloc fails (e.g., under a low MAGICK_LIMIT_MEMORY setting or memory pressure), the underlying allocator frees the original buffer, but ReadMIFFImage continues and performs a 1-byte write into the freed region at miff.c:1048. An attacker who can supply a crafted 3077-byte MIFF file and induce allocation failure obtains a deterministic heap UAF write primitive.

Target

Project: graphicsmagick
Location: miff.c:1048

Technical Details

ASAN: heap-use-after-free WRITE of size 1 at 0x51d0000012f4 in ReadMIFFImage (coders/miff.c:1048). The buffer was originally allocated at miff.c:1011 via _MagickAllocateResourceLimitedMemoryLoc and freed inside _MagickReallocateResourceLimitedMemoryLoc (magick/memory.c:812) when the realloc at miff.c:1034 failed; the caller does not detect the failure and keeps using the stale pointer.

Crash trace:

The PoC (3077-byte MIFF image file) triggers a deterministic heap-use-after-free (write) bug in GraphicsMagick's MIFF image reader. 

All 3 runs in a fresh container produced identical ASAN reports:
- Error: heap-use-after-free on address 0x51d0000012f4
- WRITE of size 1 at ReadMIFFImage coders/miff.c:1048
- The memory was freed at ReadMIFFImage coders/miff.c:1034 via _MagickReallocateResourceLimitedMemoryLoc (magick/memory.c:812), indicating a realloc failure path where the old pointer is freed but then written to.
- Originally allocated at ReadMIFFImage coders/miff.c:1011 via _MagickAllocateResourceLimitedMemoryLoc (magick/memory.c:959)
- Exit code: 1 in all 3 runs

The bug is a classic use-after-free pattern: a realloc call (miff.c:1034) frees the original buffer when it cannot grow it (due to MAGICK_LIMIT_MEMORY=3000 constraint), but code at miff.c:1048 continues to write to the now-freed buffer. This is a genuine memory safety vulnerability in GraphicsMagick's MIFF coder.

Reproduction

  1. Craft a ~3KB MIFF image that forces the MIFF reader to allocate then attempt to grow an internal buffer
  2. Arrange for the resource-limited realloc to fail (e.g., MAGICK_LIMIT_MEMORY=3000)
  3. GraphicsMagick parses the file; realloc frees the old buffer and returns failure
  4. ReadMIFFImage writes 1 byte to the freed buffer at miff.c:1048, corrupting heap memory

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-F1GCJ0JY.

Reference: ANT-2026-F1GCJ0JY
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict
true positive
Severity
medium
TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-24 Reported to tracker
  2. 2026-05-29 Patch released
  3. 2026-05-31 Sent to maintainer
  4. 2026-08-18 Publicly revealed
PROVENANCE

SHA-3-512 hash:

7b9bb753218d1a0d19c8d63a2ac4618d67d97df46a05a9d55eddf8f7739c710907b9e2c8e77d960dd06c7d9ce9aaf25783e3b410821848050dd4c18123c13caa

Committed 2026-05-31 00:18 PT

Revealed 2026-08-18 03:02 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-F1GCJ0JY",
  "bug_class": "Use-after-free",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-24T18:48:02+00:00",
  "description": "GraphicsMagick's MIFF image reader allocates a buffer at coders/miff.c:1011 and later attempts to grow it via realloc at miff.c:1034. When the realloc fails (e.g., under a low MAGICK_LIMIT_MEMORY setting or memory pressure), the underlying allocator frees the original buffer, but ReadMIFFImage continues and performs a 1-byte write into the freed region at miff.c:1048. An attacker who can supply a crafted 3077-byte MIFF file and induce allocation failure obtains a deterministic heap UAF write primitive.",
  "discovered_at": null,
  "location": "miff.c:1048",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "graphicsmagick",
  "reproduction": [
    "1. Craft a ~3KB MIFF image that forces the MIFF reader to allocate then attempt to grow an internal buffer",
    "2. Arrange for the resource-limited realloc to fail (e.g., MAGICK_LIMIT_MEMORY=3000)",
    "3. GraphicsMagick parses the file; realloc frees the old buffer and returns failure",
    "4. ReadMIFFImage writes 1 byte to the freed buffer at miff.c:1048, corrupting heap memory"
  ],
  "technical_details": "ASAN: heap-use-after-free WRITE of size 1 at 0x51d0000012f4 in ReadMIFFImage (coders/miff.c:1048). The buffer was originally allocated at miff.c:1011 via _MagickAllocateResourceLimitedMemoryLoc and freed inside _MagickReallocateResourceLimitedMemoryLoc (magick/memory.c:812) when the realloc at miff.c:1034 failed; the caller does not detect the failure and keeps using the stale pointer.",
  "title": "Use-after-free in miff.c:1048",
  "vendor_severity": "medium"
}