PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8866 Opensuse CVE debrief

CVE-2016-8866 describes a memory allocation failure in ImageMagick's AcquireMagickMemory function in MagickCore/memory.c. A crafted image can trigger the flaw, and NVD rates the issue 8.8/High with network reachability and user interaction required. The CVE notes this is an incomplete fix for CVE-2016-8862, so remediation should treat it as a follow-on memory-safety issue in the same processing path.

Vendor
Opensuse
Product
CVE-2016-8866
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

Teams that process untrusted images should care most: web applications with upload/thumbnail workflows, media pipelines, desktop tools that open external files, and package maintainers shipping ImageMagick. Organizations using affected ImageMagick builds or downstream distro packages listed by NVD, including openSUSE-related CPEs, should verify their patch status.

Technical summary

The vulnerable code path is AcquireMagickMemory in MagickCore/memory.c. According to the CVE text, a crafted image can cause a memory allocation failure; NVD classifies the weakness as CWE-119 and assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The public record does not spell out the exact end effect beyond unspecified impact, so defenders should treat it as a serious memory-safety problem in image parsing and processing. The CVE also explicitly states that the issue exists because a prior fix for CVE-2016-8862 was incomplete.

Defensive priority

High

Recommended defensive actions

  • Upgrade ImageMagick to a release newer than the vulnerable versions listed in the CVE and NVD record, and ensure downstream distro packages are updated too.
  • Inventory every service, library, or application that accepts or transforms user-supplied images and confirm whether it links against a vulnerable ImageMagick build.
  • Treat image uploads and conversions as untrusted input paths; isolate them with least privilege, sandboxing, and resource limits.
  • If immediate patching is not possible, reduce exposure by restricting image-processing features for untrusted content and monitoring for crashes or allocation-failure errors.
  • Validate remediation against vendor advisories or package changelogs rather than relying only on the CVE summary, since the record references a prior incomplete fix.

Evidence notes

The CVE description states that AcquireMagickMemory in MagickCore/memory.c is affected by a crafted image that triggers a memory allocation failure, and that the bug is an incomplete fix for CVE-2016-8862. NVD marks the weakness as CWE-119 and assigns CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a remotely reachable issue with user interaction required and potentially severe confidentiality, integrity, and availability impact. The NVD record also links supporting references including a Gentoo advisory, a GitHub issue, and a Red Hat bug tracker entry; several openSUSE URLs are present in the source metadata but are flagged as broken links there. Published date context is 2017-02-15, while the 2026 modified timestamp reflects later database maintenance, not initial disclosure.

Official resources

CVE published 2017-02-15T19:59:01.017Z. The source record was later modified on 2026-05-13T00:24:29.033Z; that later timestamp is database maintenance metadata, not the original issue date.