CVE-2019-9965: 
XnView MP vulnerability analysis and mitigation

XnView MP 0.93.1 on Windows contains a vulnerability that allows remote attackers to cause a denial of service (application crash) or potentially have unspecified other impact via a crafted file, related to ntdll!RtlReAllocateHeap. The vulnerability was discovered and disclosed on March 21, 2019 (Code16 Blog).

The vulnerability is related to memory corruption issues in the ntdll!RtlReAllocateHeap functionality. When processing specially crafted files, the application attempts to access invalid memory locations, leading to an exploitable crash condition. The issue manifests through an out-of-bounds read when attempting to access memory at offset 0x10 from an invalid base address (Code16 Blog).

The vulnerability can result in application crashes (denial of service) when processing maliciously crafted files. There may also be potential for other unspecified impacts, though these are not fully detailed in the available sources (Code16 Blog).

The vulnerability can be triggered by processing specially crafted files. Proof-of-concept details demonstrating the crash condition have been publicly disclosed (Code16 Blog).