CVE-2019-11037

What it actually does

Out-of-bounds write in ImagickKernel::fromMatrix() when an attacker-supplied matrix allows writing beyond the allocated array bounds in the PHP imagick extension.

Why it matters to the business

Remote attackers can crash PHP processes or achieve arbitrary code execution on servers that process untrusted image or kernel matrix data, leading to service outages or full system compromise.

How an attack unfolds

An attacker supplies a malicious matrix array to ImagickKernel::fromMatrix() that exceeds the allocated buffer size; the missing bounds check results in an out-of-bounds memory write that can be leveraged for code execution or denial of service.

How to fix it

Upgrade the imagick PHP extension to a version newer than 3.4.4. Disable the extension if the functionality is not required. Apply vendor patches or rebuild from source once a fixed release is available.

How to confirm the fix worked

Inspect the installed imagick extension version with php -i or phpinfo() and confirm it is newer than 3.4.4; review application code for direct calls to ImagickKernel::fromMatrix() with untrusted input.

Typical attack path

1. Identify a PHP application that accepts user-controlled data and passes it to ImagickKernel::fromMatrix()
2. Craft a matrix structure whose size or contents cause the write pointer to exceed the allocated array
3. Submit the malicious matrix via the affected code path
4. Trigger memory corruption to gain code execution or crash the process

How to detect it

Review web server and PHP error logs for segmentation faults or memory corruption signals around imagick calls; look for unusual process terminations in image-processing workers.

What your security team should do

• Immediately upgrade the imagick extension across all PHP deployments
• Scan codebases for usage of ImagickKernel::fromMatrix() and restrict or sanitize input
• Monitor for memory-corruption crashes in PHP workers handling image processing
• Consider disabling the imagick extension where image kernel operations are unnecessary