LiveActive security incident?Get immediate response
CVE Record

CVE-2017-14741: The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a...

The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This CVE describes a denial-of-service flaw in ImageMagick. A crafted font file can make the caption image parser enter an infinite loop, potentially tying up image-processing workers. The public sources do not show code execution, data theft, or confirmed active exploitation.

Executive priority

Treat as a reliability risk for services that process user-supplied media. Prioritize patching internet-facing upload or conversion systems, but this does not currently warrant emergency response absent exposure or exploitation evidence.

Technical view

The issue is in ReadCAPTIONImage in coders/caption.c in ImageMagick 7.0.7-3. Remote attackers may trigger an infinite loop through a crafted font file, causing denial of service. The supplied CVE data has no CVSS, CWE, CPE, or detailed affected-version matrix.

Likely exposure

Exposure is most likely where ImageMagick processes untrusted image, caption, document, or font-related input, such as upload pipelines, media conversion services, and backend batch jobs. Exact affected products and versions are incomplete in the source bundle.

Exploitation context

The source bundle does not report CISA KEV listing or active exploitation. Public evidence supports a crafted-input denial-of-service scenario, not weaponized exploitation details or broader compromise impact.

Researcher notes

Evidence is narrow: CVE text identifies ImageMagick 7.0.7-3 and ReadCAPTIONImage, while Ubuntu and Debian references show security updates. The bundle lacks CVSS, CWE, CPEs, exact fixed versions, and exploitation telemetry.

Mitigation direction

  • Apply ImageMagick security updates from Ubuntu, Debian, or your operating-system vendor.
  • Check ImageMagick upstream guidance and issue 771 for fix status and affected branches.
  • Restrict untrusted font handling in image-processing workflows where operationally feasible.
  • Isolate image-processing workers with timeouts, memory limits, and queue backpressure.
  • Monitor conversion workers for hangs, retries, and abnormal processing duration.

Validation and detection

  • Inventory systems and containers running ImageMagick or distro imagemagick packages.
  • Compare installed packages against Ubuntu USN-3681-1 and Debian DLA guidance.
  • Identify services accepting user-controlled files into ImageMagick caption or conversion paths.
  • Confirm patched environments no longer show worker hangs on safe regression tests.
  • Review uptime, queue, and timeout metrics around image-processing workloads.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-14741 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.