PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8683 Debian CVE debrief

CVE-2016-8683 covers a flaw in GraphicsMagick 1.3.25’s ReadPCXImage function for PCX files. A crafted image can trigger a memory allocation failure and a file truncation error, which NVD classifies under CWE-119 and scores as high severity. The CVE text describes remote attacker impact, while the NVD CVSS vector indicates local access with user interaction is required; either way, the issue is security-relevant for any system that processes untrusted PCX content.

Vendor
Debian
Product
CVE-2016-8683
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

Administrators and developers who deploy or embed GraphicsMagick 1.3.25, especially in workflows that accept user-supplied or externally sourced PCX images. Debian and openSUSE package maintainers/users should also review affected downstream packages listed in the NVD CPE criteria.

Technical summary

The vulnerable code path is ReadPCXImage in coders/pcx.c. Per the supplied record, a crafted PCX image can drive a memory allocation failure and a truncation error in corrupted-file handling. NVD maps the issue to CWE-119 and assigns CVSS v3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The source corpus also lists GraphicsMagick 1.3.25 as vulnerable, with downstream distro exposure recorded for Debian GNU/Linux 8.0 and openSUSE 13.2.

Defensive priority

High. Treat as a priority fix for any environment that ingests untrusted images, especially where GraphicsMagick is exposed in server-side or batch-processing pipelines.

Recommended defensive actions

  • Upgrade GraphicsMagick to a version that includes the upstream fix for ReadPCXImage/PCX parsing.
  • Apply the vendor or distribution security update referenced in the provided advisories for Debian and openSUSE.
  • Limit or sandbox image conversion workflows that process untrusted PCX files until remediation is complete.
  • Monitor for crashes or allocation/truncation errors in image-processing jobs that handle PCX content.
  • If immediate patching is not possible, temporarily disable PCX ingestion at trust boundaries.

Evidence notes

Statements here are limited to the supplied NVD record and its references. The CVE description states 'remote attackers' and 'unspecified impact,' while the NVD CVSS vector indicates local attack conditions with user interaction; this debrief preserves both by noting the discrepancy rather than resolving it beyond the source corpus. Affected versions and downstream platform entries come from the NVD CPE criteria.

Official resources

Publicly disclosed in the supplied CVE record on 2017-02-15. The source references predate disclosure and show upstream and downstream remediation activity around September-October 2016.