CVE-2016-6491: imagemagick Out-of-bounds Read
Vulnerability summary
CVE-2016-6491 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in imagemagick. EPSS estimates a 5.02% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 13-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.02%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 5.02% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- imagemagick< 6.9.6.8-r0 | < 6.9.5.3
Debian1 product
- imagemagick< 8:6.9.6.2+dfsg-2
Imagemagick1 product
- imagemagick≤ 6.9.5-3 | 7.0.1-0 | 7.0.1-1 | 7.0.1-2 | 7.0.1-3 | 7.0.1-4 | 7.0.1-5 | 7.0.1-6 | 7.0.1-7 | 7.0.1-8 | 7.0.1-9 | 7.0.1-10 | 7.0.2-0 | 7.0.2-1 | 7.0.2-2 | 7.0.2-3 | 7.0.2-4 | 7.0.2-5
Oracle1 product
- solarisEOL10.0 | 11.3
Ubuntu1 product
- imagemagick< 8:6.7.7.10-6ubuntu3.2 | < 8:6.8.9.9-7ubuntu5.2
5 vendors · 5 products
References
13 links- www.openwall.com/lists/oss-security/2016/07/28/13Mailing ListX Refsource MLISTExploitPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2016/07/28/15Mailing ListX Refsource MLISTExploitThird Party Advisory
- github.com/ImageMagick/ImageMagick/commit/dd84447b63a71fa8c3f47071b09454efc667767bX Refsource CONFIRMPatchVendor Advisory
- github.com/ImageMagick/ImageMagick/blob/6.9.5-4/ChangeLogX Refsource CONFIRMRelease NotesVendor Advisory
- www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlX Refsource CONFIRMThird Party Advisory
