CVE-2019-13135

Vulnerability

ImageMagick versions prior to 7.0.8-50 contain a use-of-uninitialized-value vulnerability in the ReadCUTImage function within coders/cut.c [1]. When processing a specially crafted CUT image, the function allocates a buffer (BImgBuff) via AcquireQuantumMemory but does not initialize its contents before use [1][2][3]. This can lead to reading uninitialized memory, potentially causing undefined behavior.

Exploitation

An attacker can exploit this vulnerability by providing a malicious CUT image file to an application using ImageMagick. No special privileges are required; the attacker only needs to deliver the crafted file to the victim (e.g., via email, web upload, or other means). The vulnerability is triggered during image decoding when ReadCUTImage processes the RLE compressed raster data without initializing the allocated buffer [1].

Impact

Successful exploitation could lead to information disclosure (reading uninitialized memory) or potentially other undefined behavior depending on the memory state. The impact is limited to the context of the ImageMagick process; however, if the uninitialized data is used in further operations, it might lead to more severe consequences such as crashes or arbitrary code execution in some scenarios.

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.8-50 and later [3]. Users should upgrade to the latest version. For ImageMagick 6, the fix is included in commit 1e59b29 [2]. No workarounds are documented; upgrading is the recommended mitigation.