PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5240 Graphicsmagick CVE debrief

CVE-2016-5240 is a denial-of-service issue in SVG image handling. The NVD record ties it to GraphicsMagick versions before 1.3.24, and the CVE description says a circularly defined SVG file can trigger an infinite loop during conversion; the description also mentions the ImageMagick SVG renderer. The record was published in 2017, with vendor and mailing-list references in 2016 indicating the issue was discussed earlier.

Vendor
Graphicsmagick
Product
CVE-2016-5240
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-27
Original CVE updated
2026-05-13
Advisory published
2017-02-27
Advisory updated
2026-05-13

Who should care

Operators of image-processing pipelines that accept untrusted SVG input, especially services running GraphicsMagick or ImageMagick for uploads, thumbnailing, document conversion, or batch rendering.

Technical summary

The primary effect is availability loss from an infinite loop in SVG processing. NVD lists the affected GraphicsMagick range as versions up to and including 1.3.23, with a CVSS 3.0 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H and weakness CWE-20. The prose description says remote attackers can cause the hang by supplying a circularly defined SVG file, so the corpus contains a wording mismatch between the narrative and the CVSS attack-vector assessment.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade GraphicsMagick to 1.3.24 or later, or confirm your packaged build includes the fix.
  • If you use ImageMagick SVG rendering, verify you are on a patched release and retest untrusted SVG handling.
  • Block or sanitize SVG content with circular or recursive references before conversion.
  • Run image conversion workers with CPU, memory, and wall-clock time limits so a hung job cannot exhaust the host.
  • Monitor for stalled conversion tasks and automatically terminate or restart workers that exceed a safe timeout.

Evidence notes

The debrief is based on the NVD CVE record published on 2017-02-27 and its official references. NVD’s CPE criteria scope GraphicsMagick through 1.3.23, and the record lists CWE-20 plus a CVSS 3.0 vector indicating high availability impact. The reference set includes the GraphicsMagick changelog, a Debian security advisory, and oss-security discussion links from 2016. The corpus also contains a textual scope mismatch: the description mentions ImageMagick’s SVG renderer, while the CPE criteria point to GraphicsMagick.

Official resources

CVE-2016-5240 was published by the CVE record on 2017-02-27. The official references in the record point to public 2016 vendor and mailing-list discussion, and NVD last modified the entry on 2026-05-13.