CVE-2016-9556

MEDIUM 5.5CVE-2016-9556 · Published 23/03/2017 · updated 17/06/2026

In short

CVE-2016-9556 is a MEDIUM (CVSS 5.5) vulnerability affecting imagemagick (imagemagick).
Chance of exploitation in the next 30 days (EPSS): 2.3%, higher than 83.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
imagemagick imagemagick	`= 7.0.3-8`	No fix yet

Description

The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.

References

lists.opensuse.org/opensuse-updates/2016-12/msg00040.html · Third Party Advisory
debian.org/security/2016/dsa-3726 · Third Party Advisory
openwall.com/lists/oss-security/2016/11/23/1 · Mailing List
openwall.com/lists/oss-security/2016/12/01/4 · Mailing List
openwall.com/lists/oss-security/2016/12/02/12 · Mailing List
securityfocus.com/bid/94492 · Third Party Advisory
blogs.gentoo.org/ago/2016/11/19/imagemagick-heap-based-buffer-overflow-in-ispixelgray-pixel-accessor-h · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
ImageMagick/ImageMagick commit ce98a7a · Issue Tracking

More vulnerabilities in imagemagick

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

imagemagick

= 7.0.3-8

No fix yet

More vulnerabilities in imagemagick

See all →