CVE-2017-13737

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26...

6.5 MediumFix available

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.68%Down 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

Record: CVE-2017-13737
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

Record: CVE-2017-13737
Updated: 2026-11-02

EUVDEUVD-2017-5254 No score

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

Record: EUVD-2017-5254
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v5jv-6f5x-646h 6.5

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26...

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

Record: GHSA-v5jv-6f5x-646h
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 6.5

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

Record: CVE-2017-13737
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-13737 6.5

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

Record: DEBIAN-CVE-2017-13737
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-13737 6.5

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.

Record: UBUNTU-CVE-2017-13737
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUSN-4222-1 No score

graphicsmagick vulnerabilities

It was discovered that GraphicsMagick incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

Record: USN-4222-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`graphicsmagick` Debian:12	before 1.3.26-15	1.3.26-15
`graphicsmagick` Debian:13	before 1.3.26-15	1.3.26-15
`graphicsmagick` Debian:14	before 1.3.26-15	1.3.26-15
`graphicsmagick` Debian:7 From an advisory covering 2 CVEs	before 1.3.16-1.1+deb7u11, plus listed versions 1.3.16-1.11.3.16-1.1+deb7u11.3.16-1.1+deb7u101.3.16-1.1+deb7u21.3.16-1.1+deb7u3 Show 6 moreShow less 1.3.16-1.1+deb7u41.3.16-1.1+deb7u51.3.16-1.1+deb7u61.3.16-1.1+deb7u71.3.16-1.1+deb7u81.3.16-1.1+deb7u9	1.3.16-1.1+deb7u11
`graphicsmagick` Debian:8 From an advisory covering 31 CVEs	before 1.3.20-3+deb8u4, plus listed versions 1.3.20-3+deb8u11.3.20-3+deb8u21.3.20-3+deb8u3	1.3.20-3+deb8u4
`graphicsmagick` Debian:9 From an advisory covering 56 CVEs	before 1.3.30+hg15796-1~deb9u1, plus listed versions 1.3.25-81.3.26-11.3.26-101.3.26-111.3.26-12 Show 24 moreShow less 1.3.26-131.3.26-141.3.26-151.3.26-161.3.26-171.3.26-181.3.26-191.3.26-21.3.26-31.3.26-41.3.26-51.3.26-61.3.26-71.3.26-81.3.26-91.3.27-11.3.27-21.3.27-31.3.27-41.3.28-11.3.28-21.3.29+hg15665-11.3.29-11.3.30-1	1.3.30+hg15796-1~deb9u1
`graphicsmagick` Ubuntu:Pro:14.04:LTS	before 1.3.18-1ubuntu3.1+esm3, plus listed versions 1.3.16-1.1ubuntu21.3.16-1.1ubuntu31.3.18-1ubuntu31.3.18-1ubuntu3.11.3.18-1ubuntu3.1+esm11.3.18-1ubuntu3.1+esm2	1.3.18-1ubuntu3.1+esm3
`graphicsmagick` Ubuntu:16.04:LTS	before 1.3.23-1ubuntu0.3, plus listed versions 1.3.21-31.3.23-11.3.23-1build11.3.23-1ubuntu0.11.3.23-1ubuntu0.2	1.3.23-1ubuntu0.3
`graphicsmagick` Ubuntu:16.04:LTS From an advisory covering 15 CVEs	before 1.3.23-1ubuntu0.3, plus listed versions 1.3.21-31.3.23-11.3.23-1build11.3.23-1ubuntu0.11.3.23-1ubuntu0.2	1.3.23-1ubuntu0.3

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-13737 is a medium vulnerability (CVSS 6.5) in Graphicsmagick, published August 29, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.68%, the 85th percentile. Fixed in graphicsmagick 1.3.26-15.

References

Show 26 moreShow less