CVE-2019-13136

Vulnerability

An integer overflow vulnerability exists in the TIFFSeekCustomStream function in coders/tiff.c in ImageMagick before version 7.0.8-50. Specifically, in the SEEK_CUR case, the computation profile->offset + offset is performed without proper bounds checking, leading to a possible integer overflow. This issue is documented in [2] and was resolved in commit fe5f4b8 [1].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted TIFF file that triggers the vulnerable code path. No authentication or special privileges are required; the victim simply needs to process the malicious file using an affected version of ImageMagick. The overflow occurs during the seeking operation, which may lead to out-of-bounds access or other undefined behavior.

Impact

Successful exploitation could result in denial of service (e.g., application crash) or potentially memory corruption and arbitrary code execution, depending on the environment. The exact impact is not fully described in the available references, but integer overflows in such contexts are often security-critical.

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.8-50 and later. Users should upgrade to this version or apply the patch from commit fe5f4b8 [1]. No workarounds are documented.