CVE-2016-9298
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6...
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
- Record
CVE-2016-9298- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
- Record
CVE-2016-9298- Updated
- 2026-11-02
EUVDEUVD-2016-10109 No score
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
- Record
EUVD-2016-10109- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8f6x-7gf8-r8pq
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6...
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
- Record
GHSA-8f6x-7gf8-r8pq- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
- Record
CVE-2016-9298- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-9298
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
- Record
DEBIAN-CVE-2016-9298- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0229 No score
Updated imagemagick packages fix security vulnerabilities
The imagemagick package has been updated to version 6.9.9.41 which fixes several unspecified security vulnerabilities. This update fixes several vulnerabilities in imagemagick, including: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed GIF, TTF, SVG, TIFF, PCX, JPG or SFW files are processed.
Several packages have been rebuilt for the updated ImageMagick.
- Record
MGASA-2018-0229- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagemagickDebian:12 |
before 8:6.9.6.5+dfsg-1 | 8:6.9.6.5+dfsg-1 |
imagemagickDebian:13 |
before 8:6.9.6.5+dfsg-1 | 8:6.9.6.5+dfsg-1 |
imagemagickDebian:14 |
before 8:6.9.6.5+dfsg-1 | 8:6.9.6.5+dfsg-1 |
converseenMageia:6 |
before 0.9.6.2-1.3.mga6 | 0.9.6.2-1.3.mga6 |
cuneiform-linuxMageia:6 |
before 1.1.0-9.2.mga6 | 1.1.0-9.2.mga6 |
dvdauthorMageia:6 |
before 0.7.2-2.2.mga6 | 0.7.2-2.2.mga6 |
emacsMageia:6 |
before 24.5-8.3.mga6 | 24.5-8.3.mga6 |
imagemagickMageia:6 |
before 6.9.9.41-1.mga6 | 6.9.9.41-1.mga6 |
inkscapeMageia:6 |
before 0.92.1-2.2.mga6 | 0.92.1-2.2.mga6 |
k3dMageia:6 |
before 0.8.0.5-5.2.mga6 | 0.8.0.5-5.2.mga6 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kxstitchMageia:6 |
before 2.0.0-2.2.mga6 | 2.0.0-2.2.mga6 |
libopenshotMageia:6 |
before 0.1.8-1.2.mga6 | 0.1.8-1.2.mga6 |
ocaml-glmliteMageia:6 |
before 0.03.51-17.2.mga6 | 0.03.51-17.2.mga6 |
perl-Image-SubImageFindMageia:6 |
before 0.30.0-6.2.mga6 | 0.30.0-6.2.mga6 |
pfstoolsMageia:6 |
before 2.0.6-3.2.mga6 | 2.0.6-3.2.mga6 |
php-imagickMageia:6 |
before 3.4.1-6.2.mga6 | 3.4.1-6.2.mga6 |
php-magickwandMageia:6 |
before 1.0.9.2-10.2.mga6 | 1.0.9.2-10.2.mga6 |
psiconvMageia:6 |
before 0.9.8-26.2.mga6 | 0.9.8-26.2.mga6 |
pythonmagickMageia:6 |
before 0.9.12-7.2.mga6 | 0.9.12-7.2.mga6 |
ruby-rmagickMageia:6 |
before 2.15.4-12.2.mga6 | 2.15.4-12.2.mga6 |
synfigMageia:6 |
before 1.2.1-2.2.mga6 | 1.2.1-2.2.mga6 |
vdr-plugin-skinelchiMageia:6 |
before 0.2.8-8.2.mga6 | 0.2.8-8.2.mga6 |
vdr-plugin-skinenigmangMageia:6 |
before 0.1.2-10.2.mga6 | 0.1.2-10.2.mga6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-9298 is a medium vulnerability (CVSS 5.5) in Imagemagick, published January 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in imagemagick 8:6.9.6.5+dfsg-1.