CVE-2019-19950

Vulnerability

In GraphicsMagick 1.4 snapshot-20190403 Q8, a use-after-free vulnerability exists in the ThrowLoggedException function in magick/error.c. This occurs when processing a crafted image file that causes the WritePS2Image function (in coders/ps2.c) to invoke the error handling path, leading to a read from freed memory [1].

Exploitation

An attacker can trigger the vulnerability by providing a specially crafted image file and using the gm convert command to convert it to PS2 format (e.g., gm convert $poc ./out.ps2). No authentication or network access is required; the attack is local and depends on user interaction to process the malicious file [1].

Impact

Successful exploitation results in a heap-use-after-free, which can cause a crash (denial of service). In more sophisticated scenarios, an attacker may be able to achieve arbitrary code execution in the context of the GraphicsMagick process [1].

Mitigation

As of the publication date (December 24, 2019), no fix was available in the referenced bug report. Users should monitor for updates from the GraphicsMagick project and apply any patches when released. Until a fix is available, avoid processing untrusted image files with the affected version [1].