CVE-2019-19948

Vulnerability

In ImageMagick 7.0.8-43 Q16, the function WriteSGIImage in coders/sgi.c contains a heap-based buffer overflow. The issue occurs when processing a specially crafted SGI image file; the write operation at line 1051 accesses memory 8 bytes before an allocated 524288-byte region, leading to a heap-buffer-overflow. The affected version is ImageMagick 7.0.8-43 Q16 [1].

Exploitation

An attacker must supply a malicious SGI file that triggers the overflow when ImageMagick attempts to convert or write the image using the convert command or similar operation. The exploit vector is through file processing, requiring no special privileges—any user who can open the crafted file (e.g., via magick convert or web uploads) can trigger the vulnerability. The attack does not need authentication beyond local file access [1].

Impact

A successful exploit can cause a heap-buffer-overflow, potentially leading to application crash (denial of service) or arbitrary code execution in the context of the affected process. The overflow is classified as a high-severity issue due to the possibility of remote code execution via crafted image files [1].

Mitigation

As of the publication date (2019-12-24), no patched version has been released. The vendor was notified via the issue tracker [1]. Users should refrain from processing untrusted SGI files. Monitor vendor updates for a fix; the issue is not listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog. If no patch is forthcoming, consider removing support for the SGI format or using alternative image libraries.