CVE-2019-11472

Vulnerability

In ImageMagick 7.0.8-41 Q16, the ReadXWDImage function in coders/xwd.c does not validate the bitmap_bit_order field of the XWD header. When the header indicates neither MSBFirst nor LSBFirst, a subsequent division operation uses an uninitialized or zero divisor, resulting in a divide-by-zero error (floating-point exception). This affects all versions up to and including the reported build [1].

Exploitation

An attacker can craft a malicious XWD image file with a header where the bitmap_bit_order byte is set to a value other than MSBFirst or LSBFirst. No authentication or special privileges are required; the victim only needs to process the file with an affected version of ImageMagick, for example by running identify -verbose on the file [1].

Impact

Successful exploitation causes a denial of service via a floating-point exception (FPE), crashing the ImageMagick process. The crash is immediate and does not require any user interaction beyond opening the file. No code execution or data disclosure is reported [1].

Mitigation

The issue is fixed in commit f663dfb for ImageMagick6, which adds a check that rejects headers with invalid bitmap_bit_order values [4]. Users should update to a patched version of ImageMagick (7.0.8-42 or later, or any release incorporating the fix). No workaround is available; the only mitigation is to avoid processing untrusted XWD files until the software is updated.