CVE-2016-8866: imagemagick
Vulnerability summary
CVE-2016-8866 is a high (CVSS 8.8) vulnerability in imagemagick. EPSS estimates a 4.80% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 15-02-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862.
CVSS metrics
4 scores · 2 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.80%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
+0.19 pp
From 4.61% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundImagemagick
Maturity: poc
Exploit Reference (blogs.gentoo.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Imagemagick1 product
- imagemagick< 6.9.6-6 | ≥ 7.0.0-0, ≤ 7.0.3-7
Ubuntu1 product
- imagemagickAll versions (No fix recorded)
3 vendors · 4 products
References
11 links- bugzilla.redhat.com/show_bug.cgi?id=1388816X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-updates/2016-12/msg00141.htmlVendor AdvisoryX Refsource SUSEBroken LinkThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2017-01/msg00006.htmlVendor AdvisoryX Refsource SUSEBroken LinkThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00085.htmlVendor AdvisoryX Refsource SUSEBroken LinkThird Party Advisory