CVE-2019-11006

Vulnerability

A heap-based buffer over-read exists in the ReadMIFFImage function of coders/miff.c in GraphicsMagick 1.4 snapshot-20190322 Q8 and earlier versions. The flaw occurs when processing a specially crafted MIFF image file containing an RLE (run-length encoding) packet, which triggers a read beyond the allocated heap buffer boundary. The over-read is located at line 1839 of coders/miff.c, as identified by AddressSanitizer [1].

Exploitation

An attacker can exploit this vulnerability by providing a malicious MIFF image file to the GraphicsMagick convert command (e.g., ./utilities/gm convert malicious.miff /dev/null). No special authentication or elevated privileges are required; the user only needs to process the malformed file with GraphicsMagick. The heap-buffer-overread is triggered directly during image decoding without any additional user interaction beyond file opening [1].

Impact

Successful exploitation results in a heap-buffer over-read, which can cause a denial of service (application crash) or potentially lead to information disclosure via out-of-bounds memory reads. The vulnerability does not directly provide remote code execution, but memory corruption could be leveraged in combination with other bugs [1].

Mitigation

As of the publication date (April 8, 2019), no patched version has been released. Users are advised to avoid processing untrusted MIFF images with GraphicsMagick 1.4 snapshot-20190322 or earlier. The vendor may issue a fix in a future release; monitoring the GraphicsMagick bug tracker [1] is recommended.