Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-7906: ImageMagick Denial of Service via Malformed File

CVE-2016-7906 · published 9 years ago

Summary

A malicious file can crash ImageMagick, making it unavailable to users. This affects ImageMagick, a popular image processing tool. To protect your system, update to the latest version of ImageMagick.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
imagemagick	imagemagick	7.0.3-2 `cpe:2.3:a:imagemagick:imagemagick:7.0.3-2:::::::*`
debian	debian_linux	8.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`

Original advisory text

magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.

References

http://www.debian.org/security/2016/dsa-3726 Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/02/1 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/02/3 Mailing List Patch Third Party Advisory
http://www.securityfocus.com/bid/93271 Third Party Advisory VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/90406972f108c4da71f998601b06ab... Patch Vendor Advisory
https://github.com/ImageMagick/ImageMagick/issues/281 Issue Tracking Patch Third Party Advisory
https://security.gentoo.org/glsa/201611-21 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published18 Jan 2017

Updated3 Nov 2026

First seen4 Aug 2026

Sources

CVE-2016-7906 · OSV

CVE-2016-7906 · NVD

Track software like this

Free during beta