CVE-2019-5086 is an integer overflow vulnerability in the flattenIncrementally function of xcftools versions prior to 1.0.7, specifically affecting the xcf2png and xcf2pnm binaries. This flaw can lead to memory corruption and arbitrary code execution when processing a specially crafted XCF file. With a CVSS score of 8.8 (High), it requires user interaction (opening a malicious file) but can result in high impact to confidentiality, integrity, and availability. There is no publicly available exploit code (Metasploit, Nuclei, ExploitDB), nor is it listed in CISA's KEV catalog, indicating no active exploitation. Community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.7CPE matchmatch criteria | cpe:2.3:a:xcftools_project:xcftools:1.0.7:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.