CVE-2019-10131

Vulnerability

An off-by-one read vulnerability exists in ImageMagick versions before 7.0.7-28 in the formatIPTCfromBuffer function within coders/meta.c. The flaw occurs when processing IPTC data in the format8BIM function, where a buffer of size count is allocated but the code reads one byte beyond the allocated memory [1][2]. This is triggered when converting a specially crafted image file.

Exploitation

A local attacker can exploit this by providing a malicious image file that, when processed by ImageMagick (e.g., via the convert command), causes an out-of-bounds read. No special privileges are required beyond the ability to run ImageMagick on the crafted file. The valgrind output confirms an invalid read of size 1 at address 0 bytes after a block of size 11 [1].

Impact

Successful exploitation allows the attacker to read one byte beyond the allocated buffer, potentially leading to information disclosure of adjacent memory. In worst-case scenarios, this could cause a crash (denial of service). The read is limited to a single byte, but repeated exploitation could leak sensitive data.

Mitigation

The fix was committed in commit cb1214c124e1bd61f7dd551b94a794864861592e [2], which changes the allocation to count+1 to ensure sufficient space. Users should upgrade to ImageMagick version 7.0.7-28 or later. No workaround is available; the vulnerability is addressed by the patch.