Critical
Security advisory
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2) pixel.green, and (3) pixel.blue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-5691
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:19 UTC · Revision 1
Source evidence
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2) pixel.green, and (3) pixel.blue.
osv:CVE-2016-5691
Complete source record
{
"id": "1d43d58ac462de3a19aa9553425d3280256846dad4b691455ae7a6dbc5f7447d",
"url": "https://osv.dev/vulnerability/CVE-2016-5691",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-5691",
"summary": "The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2) pixel.green, and (3) pixel.blue.",
"evidence": "osv:CVE-2016-5691",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-5691",
"aliases": [
"CVE-2016-5691"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick",
"type": "GIT",
"events": [
{
"introduced": "e46b7d19de7914881986ef939f690facc7a0198d"
},
{
"last_affected": "8af0c7343af5ecda6a99611333321ca283ae505a"
},
{
"fixed": "5511ef530576ed18fd636baa3bb4eda3d667665d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-0"
},
{
"last_affected": "7.0.1-0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-1"
},
{
"last_affected": "7.0.1-1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-2"
},
{
"last_affected": "7.0.1-2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-3"
},
{
"last_affected": "7.0.1-3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-4"
},
{
"last_affected": "7.0.1-4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-5"
},
{
"last_affected": "7.0.1-5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-6"
},
{
"last_affected": "7.0.1-6"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "5511ef530576ed18fd636baa3bb4eda3d667665d"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"7.0.1-0",
"7.0.1-1",
"7.0.1-2",
"7.0.1-3",
"7.0.1-4",
"7.0.1-5",
"7.0.1-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5691.json",
"vanir_signatures": [
{
"id": "CVE-2016-5691-0d876578",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125690708503204704179866250422592584464",
"297118995262517685663034534754128752549",
"71456700239368997875191045675705977984",
"310300479292880551150267313013585917428",
"75158705854446966296570889487461669595",
"256487543234322570650697034452382529675",
"101800047312087569013320574819529047408",
"278330530480765877102691904248489772845",
"269998386639281855675428201403715945157",
"222744906410054753423939657109388688498",
"31328229820292102911312279564588830172",
"230150294241990504871522991641849196906",
"303987760605767369302449797372453866768",
"199538023032157869037437909163117919625",
"281035373911219828636523423704845789944",
"134836911006447715844848858788155042871"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/5511ef530576ed18fd636baa3bb4eda3d667665d",
"target": {
"file": "coders/dcm.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-5691-9ac331bb",
"digest": {
"length": 27156,
"function_hash": "319746287147606933465858284226449158380"
},
"source": "https://github.com/imagemagick/imagemagick/commit/5511ef530576ed18fd636baa3bb4eda3d667665d",
"target": {
"file": "coders/dcm.c",
"function": "ReadDCMImage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:12:09Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick6",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "aa74980014c8246f92a200a6e431b8d8efe312e5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "6.9.4-4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"6.9.4-4",
"6.9.4-3",
"6.9.4-2",
"6.9.4-1",
"6.9.4-0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5691.json"
}
}
],
"modified": "2026-10-24T14:12:09.686826415Z",
"provider": "osv",
"references": [
"https://github.com/ImageMagick/ImageMagick/blob/6.9.4-5/ChangeLog",
"https://github.com/ImageMagick/ImageMagick/blob/7.0.1-7/ChangeLog",
"https://blog.fuzzing-project.org/46-Various-invalid-memory-reads-in-ImageMagick-WPG%2C-DDS%2C-DCM.html",
"https://github.com/ImageMagick/ImageMagick/commit/5511ef530576ed18fd636baa3bb4eda3d667665d"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"last_affected": "6.9.4-4"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-2:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-3:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-4:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-5:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-6:*:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"introduced": "7.0.1-0"
},
{
"last_affected": "7.0.1-0"
},
{
"introduced": "7.0.1-1"
},
{
"last_affected": "7.0.1-1"
},
{
"introduced": "7.0.1-2"
},
{
"last_affected": "7.0.1-2"
},
{
"introduced": "7.0.1-3"
},
{
"last_affected": "7.0.1-3"
},
{
"introduced": "7.0.1-4"
},
{
"last_affected": "7.0.1-4"
},
{
"introduced": "7.0.1-5"
},
{
"last_affected": "7.0.1-5"
},
{
"introduced": "7.0.1-6"
},
{
"last_affected": "7.0.1-6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:solaris",
"extracted_events": [
{
"range": [
{
"introduced": "11.3"
},
{
"last_affected": "11.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-5691",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443342,
"published_at": "2016-12-13T15:59:04.967+00:00"
}