CVE-2018-16323: ImageMagick XBM decoder leaks uninitialized memory via negative pixel value

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityPublic exploit code and a high EPSS score make exploitation likely, though the impact is limited to information disclosure rather than code execution.

What it is

ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file containing a negative pixel value. When ImageMagick is used as a library inside a process holding sensitive data, that memory can be exposed through the resulting image output. The flaw is an information disclosure issue, not code execution.

Impact

An attacker can read uninitialized heap memory from the host process, potentially exposing sensitive data such as credentials or keys that happen to reside in that memory. The leak is limited to whatever data is present in the uninitialized buffer.

Attack surface

Reached by supplying a crafted XBM file to any application that decodes images with the affected ImageMagick library. The CVSS vector indicates network delivery with no privileges required, but user interaction is required to get the file processed.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.49 probability (98.8th percentile) and a public Exploit-DB entry (45890) exists, indicating exploit code is available. No ransomware association is documented.

What to do

• Upgrade ImageMagick to 7.0.8-9 or later, or apply the vendor patch commit 216d117f05bff87b9dc4db55a1b1fadb38bcb786.
• Apply the Ubuntu security updates referenced in USN-3785-1 and USN-4034-1 for packaged versions.
• Restrict or disable XBM decoding in image processing pipelines that do not need the format.
• Run image decoding in a sandboxed, low-privilege process that holds no sensitive data in memory.

Detection

• Monitor for XBM files with negative pixel values or malformed headers reaching image processing services.
• Alert on ImageMagick crashes or abnormal memory-related errors during XBM decode.
• Review image upload and conversion endpoints for untrusted XBM input and log the source of such files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.