CVE-2019-5086

An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, version 1.0.7. An integer overflow can occur while walking through tiles that could be exploited to corrupt memory and execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.

• CWE-680
• CWE-190
• CWE-787

• https://lists.debian.org/debian-lts-announce/2021/02/msg00014.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00008.htmlMailing List, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0878Exploit, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0878Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00014.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00008.htmlMailing List, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0878Exploit, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0878Exploit, Third Party Advisory

Published

Nov 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5080An exploitable denial-of-service vulnerability exists in the…9.1
• CVE-2019-5081An exploitable heap buffer overflow vulnerability exists in …9.8
• CVE-2019-5082An exploitable heap buffer overflow vulnerability exists in …9.8
• CVE-2019-5083An exploitable out-of-bounds write vulnerability exists in t…8.8
• CVE-2019-5084An exploitable heap out-of-bounds write vulnerability exists…7.8
• CVE-2019-5085An exploitable code execution vulnerability exists in the DI…9.8
• CVE-2019-5087An exploitable integer overflow vulnerability exists in the …8.8
• CVE-2019-5088An exploitable memory corruption vulnerability exists in Inv…7.8
• CVE-2019-5089An exploitable memory corruption vulnerability exists in Inv…7.8
• CVE-2019-5090An exploitable information disclosure vulnerability exists i…7.5
• CVE-2019-5091An exploitable denial-of-service vulnerability exists in the…7.5
• CVE-2019-5092An exploitable heap out of bounds write vulnerability exists…8.8