CVE-2019-15139

Vulnerability

The XWD (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 contains an out-of-bounds read vulnerability in the ReadXWDImage function in coders/xwd.c. The issue occurs because the code does not validate that header.xoffset is within the bounds of the blob size, nor does it properly check header.ncolors for integer overflow when allocating memory for color entries. A crafted XWD file with a large xoffset or excessive ncolors can cause an invalid memory read, leading to a crash [1][2].

Exploitation

An attacker needs to craft a malicious XWD file and entice a user to process it with ImageMagick (e.g., via identify -verbose or convert). No authentication or special privileges are required; the attack is remote and relies on user interaction (opening or converting the file). The crash occurs when the parser attempts to read from an invalid address due to the missing offset and length checks [1][2].

Impact

Successful exploitation causes a denial-of-service (DoS) via application crash. The crash results from an out-of-bounds read that can trigger a segmentation fault (as demonstrated by AddressSanitizer). No code execution is reported; the impact is limited to service disruption and potential data loss if the program terminates while processing other images [1][2].

Mitigation

The fix was committed on the development branch in commit c78993d138bf480ab4652b5a48379d4ff75ba5f7 (reference [1]), which adds bounds checks for header.xoffset and corrects the color allocation length validation. Affected users should update ImageMagick to a version containing this fix (e.g., builds after August 18, 2019). No official release version incorporating the fix is specified in the references; therefore, building from the patched source or applying the patch is recommended. This vulnerability is not listed on the CISA KEV catalog as of the publication date.