CVE-2019-13297

Vulnerability

In ImageMagick 7.0.8-50 Q16, the AdaptiveThresholdImage function in MagickCore/threshold.c is vulnerable to a heap-based buffer over-read. The issue occurs because the function checks for a width of zero but neglects to validate whether the height is zero. When an image with a zero height is processed, the code proceeds to read beyond the allocated heap buffer, causing a crash or potential information disclosure. Affected versions include ImageMagick 7.0.8-50 and earlier versions that do not include the fix. The problem was reported in [1] and fixed in commit [3] for version 7 and commit [2] for version 6.

Exploitation

An attacker can trigger the vulnerability by providing a crafted image file that causes the AdaptiveThresholdImage function to be called with a height of zero. The proof-of-concept command from [1] is: `` magick -seed 0 -dispose Background "(" magick:netscape -lat 514x0-41 ")" "(" magick:granite -charcoal 3 -level 0%,125,0.328 ")" -combine -print "" tmp ``

No authentication or special privileges are required; the attacker only needs to convince a user or automated process to process the crafted image with ImageMagick.

Impact

Successful exploitation results in a heap-buffer-over-read, which can lead to a denial of service (crash) or potentially the disclosure of sensitive memory contents. The AddressSanitizer log from [1] shows a READ of size 4 at a wild pointer, indicating that adjacent heap data could be read. The privilege level is that of the process running ImageMagick, which may be a user's application or a server-side image processor.

Mitigation

The vulnerability is fixed in ImageMagick version 7.0.8-51 and later, as well as in ImageMagick 6 with commit [2]. Users should upgrade to a patched version immediately. The fix adds a check for both width and height being zero, returning early if either is zero. No workaround is available if an upgrade is not possible. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.