CVE-2019-13305

Vulnerability

In ImageMagick 7.0.8-50 Q16, the WritePNMImage function in coders/pnm.c contains a stack-based buffer overflow. The bug arises from a misplaced strncpy call and an off-by-one error in the bounds check. Specifically, the code copies formatted pixel data into a stack buffer pixels without first verifying that the buffer has enough space, leading to a write beyond the allocated stack memory. The affected version is ImageMagick 7.0.8-50 Q16; the issue also exists in ImageMagick 6 as per the related commit [3].

Exploitation

An attacker can trigger the overflow by providing a crafted image file that, when processed by ImageMagick's magick command with specific options (e.g., -undercolor, -compress None, and certain image compositions), causes the WritePNMImage function to write pixel data beyond the bounds of the pixels stack buffer. The proof-of-concept command from the issue [1] demonstrates the crash. No authentication is required; the attacker only needs to convince a user or service to process the malicious image.

Impact

Successful exploitation results in a stack-based buffer overflow, which can lead to memory corruption. While the immediate effect is a denial of service (crash) as shown by AddressSanitizer, under certain conditions it may be possible to achieve arbitrary code execution, depending on the stack layout and mitigations. The overflow occurs in a stack buffer of size 2048 bytes (from pixels variable), and the write is of size 1 byte beyond the buffer.

Mitigation

The fix was committed in ImageMagick commit [2] and ImageMagick6 commit [3]. The patch moves the strncpy and pointer increment after the bounds check, and corrects the comparison from >= sizeof(pixels) to >= sizeof(pixels) (actually the diff shows changing +2 to +1 in the condition). Users should update to a version containing this fix (e.g., ImageMagick 7.0.8-51 or later). If patching is not possible, avoid processing untrusted PNM images with the affected versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.