High
Security advisory
The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-5688
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:04 UTC · Revision 1
Source evidence
The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.
osv:CVE-2016-5688
Complete source record
{
"id": "e0cda7ada4dbcc536961e58ea5f529d5e2b3bcf3ea3f01d79180c0326c9941fb",
"url": "https://osv.dev/vulnerability/CVE-2016-5688",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-5688",
"summary": "The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.",
"evidence": "osv:CVE-2016-5688",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-5688",
"aliases": [
"CVE-2016-5688"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick",
"type": "GIT",
"events": [
{
"introduced": "e46b7d19de7914881986ef939f690facc7a0198d"
},
{
"last_affected": "ac72d94febc1744579bad2646685a2054c087594"
},
{
"fixed": "aecd0ada163a4d6c769cec178955d5f3e9316f2f"
},
{
"fixed": "fc43974d34318c834fbf78570ca1a3764ed8c7d7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-0"
},
{
"last_affected": "7.0.1-0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-1"
},
{
"last_affected": "7.0.1-1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-2"
},
{
"last_affected": "7.0.1-2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-3"
},
{
"last_affected": "7.0.1-3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-4"
},
{
"last_affected": "7.0.1-4"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "aecd0ada163a4d6c769cec178955d5f3e9316f2f"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "fc43974d34318c834fbf78570ca1a3764ed8c7d7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"7.0.1-0",
"7.0.1-1",
"7.0.1-2",
"7.0.1-3",
"7.0.1-4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5688.json",
"vanir_signatures": [
{
"id": "CVE-2016-5688-13ce21f0",
"digest": {
"length": 7945,
"function_hash": "72809647637280565824983334021021529635"
},
"source": "https://github.com/imagemagick/imagemagick/commit/aecd0ada163a4d6c769cec178955d5f3e9316f2f",
"target": {
"file": "MagickCore/cache.c",
"function": "OpenPixelCache"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-5688-80011e2b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"290584930245094986198409811660524185053",
"317887526420752321230979234148795944236",
"289454378081425118523668904136587896834",
"226407080177757049156873276359830884467",
"120859661043048946946333961149048632408",
"334226194622420835021555523262904689197",
"197805291447083308206149075321773785235",
"52896354688185095764008338588287758663",
"309277963772199422984263840105912057090",
"217762545086857290390415744119826831083",
"275765658176708660247917740740722594405",
"319570536527132405217467385660572697745",
"84401320335838798864761542588995076410",
"5929252833585505000467083526661866021"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/fc43974d34318c834fbf78570ca1a3764ed8c7d7",
"target": {
"file": "coders/wpg.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-5688-8c13fc1f",
"digest": {
"length": 4146,
"function_hash": "112595478332372537989784891132300193587"
},
"source": "https://github.com/imagemagick/imagemagick/commit/aecd0ada163a4d6c769cec178955d5f3e9316f2f",
"target": {
"file": "MagickCore/image.c",
"function": "CloneImage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-5688-9cf90936",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120831310446799761248751621864552862659",
"144555323116376029190532268056337195798",
"279148503738646452488520717201283591653",
"129626382430702992517780016545509344028",
"296408050992988648284932206208651883087",
"14543995638151310093237245804460465875",
"324904478738611458705314176876477885525",
"269726917320380422511519836113986622530",
"80137253431406971029631984286137869001",
"66581534854776199800096637416044424729",
"137517575582475808463823424976424700249",
"184132997090639054663596222134371318148",
"126758484386820947510164596989372935997",
"305365869112126856560107933276065003892",
"124634286631099886374741093067223652439",
"215832350195892322730113685545615517210",
"51506374230171580612940895707342760888",
"334619740070690733833776029802773487575",
"230540054804232375420774227827948302866",
"165349625123635821592165998673127278824"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/aecd0ada163a4d6c769cec178955d5f3e9316f2f",
"target": {
"file": "MagickCore/cache.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-5688-b5912e53",
"digest": {
"threshold": 0.9,
"line_hashes": [
"87843269622060485559679692963953899814",
"116489015082790016687258357910714475933",
"101025356804883231786904477750292549428",
"296022639761418808898012969989528199869"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/aecd0ada163a4d6c769cec178955d5f3e9316f2f",
"target": {
"file": "MagickCore/image.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-5688-bc7b5a5c",
"digest": {
"length": 11847,
"function_hash": "69505567914165268061112661308026142772"
},
"source": "https://github.com/imagemagick/imagemagick/commit/fc43974d34318c834fbf78570ca1a3764ed8c7d7",
"target": {
"file": "coders/wpg.c",
"function": "ReadWPGImage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:05:31Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick6",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1bfb7f3c94227f029cdddb3790d4a4b7d4aaaa07"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "6.9.4-3"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"6.9.4-3",
"6.9.4-2",
"6.9.4-1",
"6.9.4-0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5688.json"
}
}
],
"modified": "2026-10-24T14:05:31.083849724Z",
"provider": "osv",
"references": [
"https://github.com/ImageMagick/ImageMagick/commit/aecd0ada163a4d6c769cec178955d5f3e9316f2f",
"https://github.com/ImageMagick/ImageMagick/commit/fc43974d34318c834fbf78570ca1a3764ed8c7d7",
"https://github.com/ImageMagick/ImageMagick/commits/6.9.4-4",
"https://github.com/ImageMagick/ImageMagick/commits/7.0.1-5",
"https://blog.fuzzing-project.org/46-Various-invalid-memory-reads-in-ImageMagick-WPG%2C-DDS%2C-DCM.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"last_affected": "6.9.4-3"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-2:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-3:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-4:*:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"introduced": "7.0.1-0"
},
{
"last_affected": "7.0.1-0"
},
{
"introduced": "7.0.1-1"
},
{
"last_affected": "7.0.1-1"
},
{
"introduced": "7.0.1-2"
},
{
"last_affected": "7.0.1-2"
},
{
"introduced": "7.0.1-3"
},
{
"last_affected": "7.0.1-3"
},
{
"introduced": "7.0.1-4"
},
{
"last_affected": "7.0.1-4"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:solaris",
"extracted_events": [
{
"range": [
{
"introduced": "11.3"
},
{
"last_affected": "11.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-5688",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442962,
"published_at": "2016-12-13T15:59:01.217+00:00"
}