CVE-2019-12979

Vulnerability

ImageMagick 7.0.8-34 contains a use-of-uninitialized-value vulnerability in the SyncImageSettings function located in MagickCore/image.c [1]. The issue occurs when parsing density settings: the code unconditionally assigns geometry_info.rho and geometry_info.sigma to image->resolution.x and image->resolution.y without first checking the flags from ParseGeometry [1]. If the input density string does not provide rho or sigma values, the corresponding geometry_info fields remain uninitialized, leading to undefined behavior [1]. The affected version is 7.0.8-34; earlier versions may also be affected if they lack the proper fix [1].

Exploitation

An attacker would need to provide a crafted image or a malformed density string (e.g., an empty string or one lacking proper coordinate values) to trigger the code path in SyncImageSettings [1]. No special authentication or network position is required beyond the ability to process an image with ImageMagick (e.g., via a web upload service or command-line invocation). The uninitialized variable is read when the code executes the density assignment without validating the ParseGeometry flags [1].

Impact

Successful exploitation results in undefined behavior, potentially leading to information disclosure or a crash [1]. The uninitialized values may cause unexpected resolution values, which could affect downstream processing or expose memory contents through error messages or output images. The impact scope is limited to confidentiality and availability; code execution is not reported [1].

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.8-35, released on June 22, 2019, via commit 56a19e7 [1]. Users should upgrade to version 7.0.8-35 or later. No workaround is documented, and the issue is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.