CVE-2019-5086

Name: CVE-2019-5086
Creator: NVD / NIST
Published: 2019-11-21T16:15:12.937+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 3.15%

Last modified Jun 17, 2026

CVE-2019-5086 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, version 1.0.7. An integer overflow can occur while walking through tiles that could be exploited to corrupt memory and execute arbitrary code. EPSS estimates a 3.15% chance of exploitation in the next 30 days.

Description

An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, version 1.0.7. An integer overflow can occur while walking through tiles that could be exploited to corrupt memory and execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

3.15%

86.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Xcftools Project	Xcftools	1.0.7
Debian	Debian Linux	9.0

References

https://lists.debian.org/debian-lts-announce/2021/02/msg00014.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00008.htmlMailing List, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0878Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0878Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00014.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00008.htmlMailing List, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0878Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0878Exploit, Third Party Advisory

Timeline

Published: Nov 21, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-5086?

How severe is CVE-2019-5086?

CVE-2019-5086 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 3.15% probability of exploitation in the next 30 days.

How do I fix CVE-2019-5086?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-5086?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST