CVE-2019-11505

Vulnerability

A heap-based buffer overflow exists in the WritePDBImage function of coders/pdb.c in GraphicsMagick versions 1.3.8 through 1.4 snapshot-20190403 Q8. The overflow occurs in MagickBitStreamMSBWrite in magick/bit_stream.c due to insufficient bounds checking when writing pixel data. A specially crafted image file can trigger this condition during the write operation [1].

Exploitation

An attacker can trigger the overflow by supplying a malicious image file and convincing a user to process it with an affected version of GraphicsMagick (e.g., via gm convert to PDB format). No special network position or authentication is required; the vulnerability is reachable through standard image processing workflows involving untrusted user files [1].

Impact

Successful exploitation results in a heap-buffer-overflow, which can cause a denial of service (application crash) and potentially other impacts such as memory corruption or arbitrary code execution, though the exact extent is not fully disclosed in the available references [1].

Mitigation

As of the reference date no patched version is specifically identified. Users should upgrade GraphicsMagick to the latest stable release after 1.4 snapshot-20190403 once a fix is available. As a workaround, avoid processing untrusted images with affected versions. No known KEV listing exists [1].