PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10065 Imagemagick CVE debrief

CVE-2016-10065 affects ImageMagick's VIFF image parsing path, specifically ReadVIFFImage in coders/viff.c. A crafted file can trigger a denial of service, and the NVD record also notes other unspecified impact. The CVE was publicly disclosed on 2017-03-03 and is rated High by NVD.

Vendor
Imagemagick
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-03
Original CVE updated
2026-05-13
Advisory published
2017-03-03
Advisory updated
2026-05-13

Who should care

Administrators, platform owners, and developers who use ImageMagick to process untrusted image files should care most, especially in upload, conversion, preview, or batch-processing workflows.

Technical summary

The supplied description says ReadVIFFImage in ImageMagick before 7.0.1-0 can be triggered by a crafted file to cause an application crash or other unspecified impact. NVD also lists ImageMagick versions through 6.9.7-10 as vulnerable in its CPE criteria, and includes openSUSE Leap 42.1 as affected. The NVD CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and NVD classifies the issue as CWE-284. One important nuance in the record: the description says "remote attackers," while the CVSS vector indicates local access and user interaction are required.

Defensive priority

High. Patch ImageMagick promptly wherever it processes untrusted files, and verify that downstream or vendor-packaged builds include the fix. Systems that accept user-supplied image content or automate file conversion deserve the fastest attention because the NVD vector requires local/user-interaction conditions rather than broad unauthenticated network exposure.

Recommended defensive actions

  • Upgrade ImageMagick to 7.0.1-0 or a vendor-backported build that includes the fix.
  • Inventory all systems, containers, and applications that use ImageMagick, including packaged distro builds, and confirm they are not on affected versions.
  • Prioritize patching for upload, preview, conversion, and batch-processing services that accept user-supplied image files.
  • Verify that downstream security updates were actually applied, especially where vendor advisories or distro patches are used instead of upstream releases.
  • Monitor for crashes or abnormal failures in ImageMagick-based workflows until patched, and treat malformed VIFF files as suspicious input.

Evidence notes

This debrief is grounded in the official CVE/NVD record and the linked references in the supplied corpus. The NVD entry provides the CVSS vector, affected-version criteria, and CWE classification, while the linked upstream GitHub commit and issue tracker entry indicate a patch and discussion path. Additional vendor-adjacent references include the openSUSE update notice, the Red Hat bug, and the oss-security mailing list post. No exploit code or unsupported claims are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10065 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10065

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10065 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10065

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.