CVE-2016-7101

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-01-18 · updated 2026-06-17
Weakness: CWE-125

Description

The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.

Affected products

ImageMagick: before 6.9.5-8; from 7.0.0-0 before 7.0.2-10 — fixed in 6.9.5-8, 7.0.2-10

How to fix

Upgrade to a fixed version: ImageMagick 6.9.5-8, 7.0.2-10. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2016/09/26/8
http://www.securityfocus.com/bid/93181
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836776
https://github.com/ImageMagick/ImageMagick/commit/7afcf9f71043df15508e46f079387bd4689a738d
https://github.com/ImageMagick/ImageMagick/commit/8f8959033e4e59418d6506b345829af1f7a71127
http://www.openwall.com/lists/oss-security/2016/09/26/8
http://www.securityfocus.com/bid/93181
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836776
https://github.com/ImageMagick/ImageMagick/commit/7afcf9f71043df15508e46f079387bd4689a738d
https://github.com/ImageMagick/ImageMagick/commit/8f8959033e4e59418d6506b345829af1f7a71127

Get alerted when CVE-2016-7101 or the next vulnerability affects your stack