PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7996 Graphicsmagick CVE debrief

CVE-2016-7996 is a critical memory-safety flaw in GraphicsMagick’s WPG format reader. According to the NVD record, the issue affects GraphicsMagick 1.3.25 and earlier and can be triggered remotely by a crafted WPG image containing a colormap with a large number of entries. Because the flaw is a heap-based buffer overflow and the CVSS vector is network-exploitable with no privileges or user interaction, this should be treated as a high-priority patching item for any environment that processes untrusted image files.

Vendor
Graphicsmagick
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Administrators and developers running GraphicsMagick, especially services or applications that accept or transform user-supplied WPG images. Debian or other downstream package maintainers should also confirm that their packaged GraphicsMagick builds include the fix referenced by the security advisories.

Technical summary

NVD classifies the weakness as CWE-119 and describes a heap-based buffer overflow in the WPG reader. The overflow is associated with processing a colormap that contains a large number of entries. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates remote exploitation is possible without authentication or user interaction and could affect confidentiality, integrity, and availability.

Defensive priority

Urgent. The combination of network reachability, no user interaction, and critical CVSS severity makes this a priority for immediate patch validation and deployment in any system that parses untrusted WPG content.

Recommended defensive actions

  • Upgrade GraphicsMagick to a version newer than 1.3.25 that includes the vendor or downstream fix.
  • Confirm that all packaged or embedded GraphicsMagick instances in applications and containers are updated, not just the system package.
  • Treat WPG files from untrusted sources as risky input until patched; isolate image-processing workflows where practical.
  • Review Debian or other downstream security guidance referenced by the CVE record to verify distribution-specific fixed builds.
  • Add regression tests or file-handling validation around image import paths that process WPG colormaps.

Evidence notes

This debrief is based on the NVD CVE record and its references. The supplied record states: heap-based buffer overflow in the WPG format reader; affected versions are GraphicsMagick 1.3.25 and earlier; trigger condition is a colormap with a large number of entries; and the weakness is CWE-119. The record also provides the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Reference metadata includes a Debian security advisory, two oss-security mailing list entries, and a SecurityFocus advisory entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7996 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7996

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7996 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7996

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.