PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10062 Imagemagick CVE debrief

CVE-2016-10062 is a denial-of-service issue in ImageMagick’s TIFF handling. According to the NVD record published on 2017-03-02, the ReadGROUP4Image function in coders/tiff.c does not check the return value of fwrite, and a crafted file can trigger an application crash. NVD classifies the issue as CVE-2016-10062 with medium severity.

Vendor
Imagemagick
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-02
Original CVE updated
2026-05-13
Advisory published
2017-03-02
Advisory updated
2026-05-13

Who should care

Administrators and developers running ImageMagick to process untrusted image files, especially TIFF/GROUP4 content, should care most. This also matters for services that accept user-supplied uploads or automate image conversion jobs.

Technical summary

The vulnerability is in ReadGROUP4Image in coders/tiff.c. NVD maps it to CWE-388 (Error Handling) and states that failure to check fwrite return values can lead to denial of service via a crafted file. The NVD CPE criteria mark ImageMagick versions earlier than 7.0.1-10 as vulnerable.

Defensive priority

Medium priority: patch ImageMagick or backport the fix if your environment processes untrusted TIFF files.

Recommended defensive actions

  • Upgrade ImageMagick to 7.0.1-10 or a newer fixed release.
  • If you cannot upgrade immediately, apply your distribution’s security update or backported fix for the affected package.
  • Restrict or pre-screen untrusted TIFF uploads before passing them to image-processing pipelines.
  • Monitor image-conversion services for unexpected crashes or repeated failures when parsing TIFF/GROUP4 files.
  • Confirm deployed package versions against the NVD CPE range before assuming the system is fixed.

Evidence notes

The summary is based on the NVD record, which describes an unchecked fwrite return in ReadGROUP4Image and assigns CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H with CWE-388. The record’s description mentions a crafted file causing a crash, and the CPE criteria indicate vulnerability for ImageMagick versions before 7.0.1-10. Related references in the supplied corpus include Debian DSA-3799, oss-security discussion, Red Hat Bugzilla, SecurityFocus, and the ImageMagick issue tracker.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10062 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10062

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10062 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10062

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.