CVE-2020-19667

Vulnerability

A stack-based buffer overflow exists in ReadXPMImage in coders/xpm.c of ImageMagick version 7.0.10-7 and possibly earlier versions. The vulnerability occurs at line 232 in the ParseXPMColor function, where a read of size 1 exceeds the bounds of a stack-allocated buffer target[4096] (declared at line 251). This is triggered when processing a specially crafted XPM image file [1].

Exploitation

An attacker needs to supply a malicious XPM file as input. No authentication or special privileges are required; the attack can be performed by convincing a user (or an automated service) to open the file with ImageMagick (e.g., convert malicious.xpm output.png). The overflow is a stack-based read overflow, which in the ASAN trace shows a READ of size 1 at an address past the target buffer. While the crash is easily reproducible, the exact exploitation complexity depends on the memory layout and defenses [1].

Impact

Successful exploitation causes an out-of-bounds read, leading to a denial of service (application crash) as reported. Depending on the environment and mitigations, this could potentially be leveraged for information disclosure or, in a worst-case scenario, arbitrary code execution if an attacker can control the overflow to corrupt critical stack data [1].

Mitigation

The official fix was committed to the ImageMagick repository after the issue was reported. Users should update to a version newer than 7.0.10-7 that includes the patch. The issue is tracked on GitHub issue #1895 [1]. No specific workaround is provided other than avoiding processing untrusted XPM files until the patch is applied.