CVE-2019-13303

Vulnerability

In ImageMagick 7.0.8-50 Q16, a heap-based buffer over-read exists in the CompositeImage function in MagickCore/composite.c at line 666. The bug occurs because the loop that copies pixel channels iterates based on GetPixelChannels(image) (the destination image) instead of GetPixelChannels(source_image) (the source image). If the source image has fewer channels than the destination, the loop reads beyond the source pixel's allocated memory, causing a heap-buffer-overread [1]. The issue was introduced prior to the fix commit [2]. The vulnerable code path is reachable via magick command-line operations that involve compositing or layer comparisons, such as -layers compare-overlay or -layers compare-any [1].

Exploitation

An attacker can trigger the heap-buffer-overread by crafting a sequence of ImageMagick operations that cause CompositeImage to be called with a source image that has fewer channels than the destination image. The provided reproducer uses magick with -layers compare-overlay and -layers compare-any commands, combined with options like -region, -evaluate-sequence, and -extract, to create images with mismatched channel counts [1]. No authentication or special privileges are required if the attacker can supply the command line or a crafted image file to a victim processing untrusted input. The over-read occurs during normal processing; no race window is needed.

Impact

A successful heap-buffer-overread can lead to information disclosure (reading beyond the allocated buffer) or potentially a crash (denial of service). The ASAN report indicates a read of size 4 at a heap address, which could expose adjacent memory contents [1]. In more severe scenarios, depending on the memory layout, an attacker might exploit the over-read to craft a more serious vulnerability, though the primary impact is information disclosure or crash.

Mitigation

The fix was committed in ImageMagick commit d29148fae06c01ef215940e084cf41853c117bab, which changes the loop in CompositeImage to iterate using GetPixelChannels(source_image) instead of GetPixelChannels(image) [2]. Users should upgrade to ImageMagick version 7.0.8-51 or later, which includes this patch. As a workaround, avoid processing untrusted image files or command lines that use the affected layer comparison operations. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.