PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7446 Opensuse CVE debrief

CVE-2016-7446 is a critical buffer overflow in GraphicsMagick 1.3.24 affecting MVG and SVG rendering code. NVD rates the issue 9.8/CRITICAL with network attack, no privileges, and no user interaction required. The record also notes this flaw exists because of an incomplete patch for CVE-2016-2317.

Vendor
Opensuse
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-06
Original CVE updated
2026-05-13
Advisory published
2017-02-06
Advisory updated
2026-05-13

Who should care

Security teams running GraphicsMagick 1.3.24 or downstream packages on Debian 8.0, openSUSE Leap 42.1, or openSUSE 13.2 should care most. Any environment that processes untrusted MVG or SVG content should prioritize review.

Technical summary

The vulnerability is classified as CWE-119 and described as a buffer overflow in GraphicsMagick’s MVG and SVG rendering paths. NVD’s CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable memory-corruption issue with potentially severe impact. The NVD description says the flaw remained due to an incomplete fix for CVE-2016-2317, which suggests a partially addressed code path or regression in the prior remediation.

Defensive priority

High. This is a network-reachable memory corruption issue with no auth or interaction required, and the CVSS score indicates potentially full confidentiality, integrity, and availability impact. Prioritize patching or package upgrades before routine maintenance work.

Recommended defensive actions

  • Upgrade GraphicsMagick to a version that includes the complete fix for CVE-2016-7446 and the prior CVE-2016-2317 remediation.
  • Check vendor advisories and downstream package updates for Debian, openSUSE Leap 42.1, and openSUSE 13.2.
  • Restrict or sandbox any service that accepts untrusted MVG or SVG input until patched.
  • Add temporary controls to reduce exposure from user-supplied image conversion or rendering workflows.
  • Validate whether any internal applications embed GraphicsMagick for file processing and include them in remediation scope.

Evidence notes

The supplied NVD record identifies GraphicsMagick 1.3.24 as the affected product and lists vulnerable CPEs for Debian 8.0, openSUSE Leap 42.1, and openSUSE 13.2. It classifies the weakness as CWE-119 and provides CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The description explicitly says the overflow is in MVG and SVG rendering code and that it exists due to an incomplete patch for CVE-2016-2317. The CVE was published on 2017-02-06 and the NVD source snapshot was modified on 2026-05-13.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7446 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7446

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7446 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7446

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.