{"id":"CVE-2016-7446","aliases":["DEBIAN-CVE-2016-7446","DLA-1401-1","DLA-651-1","EUVD-2016-8299","GHSA-v9fv-mjvx-27p4","SUSE-SU-2016:2724-1","UBUNTU-CVE-2016-7446"],"status":"published","title":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote...","description":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03987,"percentile":0.90573,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-10-11T00:00:00Z","modified":"2026-09-22T07:01:54Z","fixes":[{"ecosystem":"Debian:12","package":"graphicsmagick","fixed_in":["1.3.25-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphicsmagick","fixed_in":["1.3.25-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphicsmagick","fixed_in":["1.3.25-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"graphicsmagick","fixed_in":["1.3.18-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"graphicsmagick","fixed_in":["1.3.23-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.20-3+deb8u3"}]}],"versions":["1.3.20-3+deb8u1","1.3.20-3+deb8u2"],"bundled":27},{"source":"osv","ecosystem":"Debian:7","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.16-1.1+deb7u4"}]}],"versions":["1.3.16-1.1","1.3.16-1.1+deb7u1","1.3.16-1.1+deb7u2","1.3.16-1.1+deb7u3"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-4.46.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-4.46.1"}]}],"bundled":26},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1ubuntu3.1"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.23-1ubuntu0.1"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"graphicsmagick","product":"graphicsmagick"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374233","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-10/msg00094.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/93074","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-10/msg00097.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/09/18/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7446"},{"url":"https://github.com/advisories/GHSA-v9fv-mjvx-27p4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7446","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000399","tags":["report"]},{"url":"https://bugzilla.suse.com/1000434","tags":["report"]},{"url":"https://bugzilla.suse.com/1000436","tags":["report"]},{"url":"https://bugzilla.suse.com/1000689","tags":["report"]},{"url":"https://bugzilla.suse.com/1000690","tags":["report"]},{"url":"https://bugzilla.suse.com/1000691","tags":["report"]},{"url":"https://bugzilla.suse.com/1000692","tags":["report"]},{"url":"https://bugzilla.suse.com/1000693","tags":["report"]},{"url":"https://bugzilla.suse.com/1000695","tags":["report"]},{"url":"https://bugzilla.suse.com/1000698","tags":["report"]},{"url":"https://bugzilla.suse.com/1000700","tags":["report"]},{"url":"https://bugzilla.suse.com/1000704","tags":["report"]},{"url":"https://bugzilla.suse.com/1000707","tags":["report"]},{"url":"https://bugzilla.suse.com/1000711","tags":["report"]},{"url":"https://bugzilla.suse.com/1001066","tags":["report"]},{"url":"https://bugzilla.suse.com/1001221","tags":["report"]},{"url":"https://bugzilla.suse.com/1002206","tags":["report"]},{"url":"https://bugzilla.suse.com/1002209","tags":["report"]},{"url":"https://bugzilla.suse.com/1002422","tags":["report"]},{"url":"https://bugzilla.suse.com/1003629","tags":["report"]},{"url":"https://bugzilla.suse.com/1005123","tags":["report"]},{"url":"https://bugzilla.suse.com/1005125","tags":["report"]},{"url":"https://bugzilla.suse.com/1005127","tags":["report"]},{"url":"https://bugzilla.suse.com/999673","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8684","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7446","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7446","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7446","description":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.","status":"published","published":"2017-02-06T17:00:00Z","modified":"2024-08-06T01:57:47.626Z","updated_at":"2026-11-02T14:33:36.175943Z"}],"euvd":[{"id":"EUVD-2016-8299","description":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.","status":"published","published":"2017-02-06T17:00:00Z","modified":"2024-08-06T01:57:47Z","updated_at":"2026-11-03T02:22:32.939633Z"}],"ghsa":[{"id":"GHSA-v9fv-mjvx-27p4","title":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote...","description":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.","status":"published","published":"2022-05-14T01:10:36Z","modified":"2023-02-02T05:03:12Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:35.560043Z"}],"nvd":[{"id":"CVE-2016-7446","description":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.","status":"published","published":"2017-02-06T17:59:00.187Z","modified":"2026-06-17T00:53:05.053Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"CVE-2016-7446","description":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.","status":"published","published":"2017-02-06T17:59:00.187Z","modified":"2026-03-15T14:22:49.331365Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-7446","description":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.","status":"published","published":"2017-02-06T17:59:00.187Z","modified":"2026-09-22T07:01:54.70549861Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-7446","description":"Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.","status":"published","published":"2017-02-06T17:59:00Z","modified":"2026-04-22T10:56:40.0424Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-1401-1","title":"graphicsmagick - security update","status":"published","published":"2018-06-27T00:00:00Z","modified":"2026-03-09T01:01:07.175701Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-651-1","title":"graphicsmagick - security update","status":"published","published":"2016-10-11T00:00:00Z","modified":"2026-03-09T02:11:25.528524Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"SUSE-SU-2016:2724-1","title":"Security update for GraphicsMagick","description":"\nThis update for GraphicsMagick fixes the following issues:\n\nThese vulnerabilities could be triggered by processing specially crafted image files,\nwhich could lead to a process crash or resource consumtion, or potentially have\nunspecified futher impact.\n\n- CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123)\n- CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127)\n- CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125)\n- CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629)\n- CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422)\n- CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711)\n- CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707)\n- CVE-2016-7531: Pbd file out of bound access (bsc#1000704)\n- CVE-2016-7529: Out-of-bound in quantum handling (bsc#1000399)\n- CVE-2016-7528: Out-of-bound access in xcf file coder (bsc#1000434)\n- CVE-2016-7527: Out-of-bound access in wpg file coder: (bsc#1000436)\n- CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700)\n- CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698)\n- CVE-2016-7519: Out-of-bounds read in coders/rle.c (bsc#1000695)\n- CVE-2016-7517: Out-of-bounds read in coders/pict.c (bsc#1000693)\n- CVE-2016-7516: Out-of-bounds problem in rle, pict, viff and sun files (bsc#1000692)\n- CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689)\n- CVE-2016-7446 CVE-2016-7447 CVE-2016-7448 CVE-2016-7449: various issues fixed in 1.3.25 (bsc#999673)\n- CVE-2016-7101: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221)\n- CVE-2016-6823: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066)\n- CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691)\n- CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690)\n- Divide by zero in WriteTIFFImage (bsc#1002206)\n- Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209)\n","status":"published","published":"2016-11-04T10:18:42Z","modified":"2026-02-04T03:28:22.415799Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}