CVE-2019-13306

Vulnerability

A stack-based buffer overflow exists in ImageMagick 7.0.8-50 Q16 and possibly earlier versions, located in the WritePNMImage function in coders/pnm.c. The overflow is due to off-by-one errors in bounds checking, specifically in two locations where the condition if ((q-pixels+extent+1) >= sizeof(pixels)) is too conservative, allowing a write of one extra byte beyond the buffer [1][2][3].

Exploitation

An attacker can trigger the vulnerability by providing a crafted image file or command-line arguments that cause ImageMagick to write a PNM image with a specific sequence of operations. The provided proof-of-concept uses magick -seed 0 -dispose Previous -compress None "(" magick:rose +repage ")" "(" magick:logo -level 64,0%,0.874 ")" -loop 5 tmp [1]. This results in a stack-buffer-overflow as detected by AddressSanitizer. No authentication or special privileges are required beyond the ability to execute ImageMagick commands.

Impact

Successful exploitation of this stack-based buffer overflow could lead to arbitrary code execution or a denial of service. The vulnerability allows an attacker to overwrite stack memory, potentially gaining control of the execution flow. The CVSS v3.1 score is not provided in the references, but the impact is considered high.

Mitigation

The vulnerability was addressed in ImageMagick version 7.0.8-51 by fixing the off-by-one errors, changing the condition to if ((q-pixels+extent+2) >= sizeof(pixels)) [3]. A similar fix was applied to ImageMagick6 [2]. Users should upgrade to the patched version. As a workaround, avoid processing untrusted PNM files until an update is applied.