CVE-2019-9964: 
XnView MP vulnerability analysis and mitigation

XnView MP 0.93.1 on Windows contains a vulnerability that allows remote attackers to cause a denial of service (application crash) or potentially have unspecified other impact through a crafted file. The vulnerability is specifically related to ntdll!RtlpNtMakeTemporaryKey functionality. This vulnerability was disclosed on March 23, 2019 and is tracked as CVE-2019-9964 (NVD, CVE).

The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-119, which relates to Improper Restriction of Operations within the Bounds of a Memory Buffer. The technical analysis reveals that the issue manifests in the ntdll!RtlpNtMakeTemporaryKey component of the application (NVD).

The vulnerability can result in a denial of service condition through application crashes. Additionally, there may be potential for unspecified other impacts, though these are not fully detailed in the available sources. The high CVSS score indicates potential for significant impact on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability can be triggered by remote attackers through the use of a crafted file. A proof of concept exploit has been documented and is publicly available (Code610 Blog).