VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 14, 2019· Updated Aug 5, 2024

CVE-2019-17540

CVE-2019-17540

Description

Heap-based buffer overflow in ImageMagick's ReadPSInfo function before 7.0.8-54 allows denial of service or potential code execution via crafted PostScript file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap-based buffer overflow in ImageMagick's ReadPSInfo function before 7.0.8-54 allows denial of service or potential code execution via crafted PostScript file.

Vulnerability

A heap-based buffer overflow exists in the ReadPSInfo function in coders/ps.c of ImageMagick before version 7.0.8-54. The flaw is triggered when processing a specially crafted PostScript file, leading to memory corruption [1][2].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious PostScript file that, when processed by ImageMagick, causes a heap overflow. No authentication or special privileges are required; user interaction (e.g., opening the file) is sufficient to trigger the bug [1].

Impact

Successful exploitation results in a heap-based buffer overflow, which can lead to a denial of service (crash) or, potentially, arbitrary code execution in the context of the user running ImageMagick [1][2].

Mitigation

Upgrade to ImageMagick version 7.0.8-54 or later. The fix was introduced in the commits shown in reference [1]. Debian distributions (bullseye, bookworm, trixie, sid) have released updated packages [2]. If upgrading is not immediately possible, avoid processing untrusted PostScript files with ImageMagick.

References
  1. Comparing 7.0.8-53...7.0.8-54 · ImageMagick/ImageMagick
  2. CVE-2019-17540

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

13

Patches

1
08af6505d262

...

https://github.com/imagemagick/imagemagickCristyJul 16, 2019via osv
commit
1 file changed · +1 −1
  • ChangeLog+1 −1 modified
    @@ -1,5 +1,5 @@
 2019-07-16  7.0.8-54 Cristy  <quetzlzacatenango@image...>
-  * Release ImageMagick version 7.0.8-54, GIT revision 15911:853b9dc:20190716.
+  * Release ImageMagick version 7.0.8-54, GIT revision 15916:e868e22:20190716.
 
 2019-07-08  7.0.8-54 Cristy  <quetzlzacatenango@image...>
    * resolve division by zero  (reference

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.