Medium
Security advisory
The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-16642
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:25 UTC · Revision 1
Source evidence
The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write.
osv:CVE-2018-16642
Complete source record
{
"id": "c9ad46f00d424e14219e8ea56e748fcf6fb5104b0ad9bd02388a7c82c7646482",
"url": "https://osv.dev/vulnerability/CVE-2018-16642",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-16642",
"summary": "The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write.",
"evidence": "osv:CVE-2018-16642",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-16642",
"aliases": [
"CVE-2018-16642"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick",
"type": "GIT",
"events": [
{
"introduced": "3696d93063973800363e2a5578b6d82312ae7c05"
},
{
"last_affected": "3696d93063973800363e2a5578b6d82312ae7c05"
},
{
"fixed": "cc4ac341f29fa368da6ef01c207deaf8c61f6a2e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.7-37:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.7-37"
},
{
"last_affected": "7.0.7-37"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "cc4ac341f29fa368da6ef01c207deaf8c61f6a2e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"7.0.7-37"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16642.json",
"vanir_signatures": [
{
"id": "CVE-2018-16642-1e09a338",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300241611087885807893402881423120301017",
"233319732431438604094915454378745026554",
"1121590166619683826650404507143740889",
"195780326457530436193200552036235776613",
"209423201584587416006319475595203747533",
"251894047603090528347342898477986275912",
"16206041500551614227360404643675103363",
"181950443314517337213611969778266675112",
"140146071862453122979714745524725950322",
"293639656049659381439432883233930061136",
"53575772935281066248870374081976059711",
"49194645636644734054965563173279350822",
"104689859407008510517900176824518387659",
"287979288517239566299244475921222815993",
"15872358869704923665298893604362024248",
"301071719179596027446821342256047135256",
"137434997058617968267689340924315060606",
"196061521067393650968981833786146455729",
"333333900715572240716798278547956172912",
"16737897415242292915232835434618954817",
"187583662540136960630633358395375138061",
"47371794787713767702228522115058655519",
"252411255145663240791089307256367679861",
"222598667632007968269040371429135854739",
"339708303592273743489915389519686590179",
"264876387884580990492725793130722134169",
"68323132035293020451231473206172455987",
"322513020178410997182228097473486817037",
"289410839400585565763192318277198554595",
"43173993899836444341701627056823091744",
"187583662540136960630633358395375138061",
"47371794787713767702228522115058655519",
"252411255145663240791089307256367679861",
"222598667632007968269040371429135854739",
"153356795560776817648989146904732361328",
"328157110284421163395166231549752699472",
"128011503187951768054479910956781153091",
"57719457282236165344598289275256115148",
"91794615232585081307222415967885633275",
"112936055729214281836766600462286239459",
"119859507861030615548008207091771676094",
"287979288517239566299244475921222815993",
"296202915652744921405100257105764390010",
"247150939643836653841183791585942424054",
"270312678384849432848536356204767338847",
"318478266732889627196422765315702091400",
"145846112849091895567064255129922694306",
"12255131327767123371150212348402890070",
"77313091950850806891681230400816348940",
"253248320211358654936382876870343328340",
"183684216959104135303207875449504896742",
"270190729631575020287647143759752328911",
"77747243084858033652343110018924348495",
"89857639566810222199887534520611278548",
"287516083539568745588246816208334205050",
"157191906144786826536479121613787786908",
"231825325258064780080579669974263382105",
"125995880315864881469573225205568883976",
"162816788286878939916407882233218073834",
"275561426928581914673352386494985734515",
"64519255898185507593313106936712998854",
"77670981584699310824516239408117840999",
"145846112849091895567064255129922694306",
"36169188416381811677370631386617192123",
"257322266318300508533783174089131002607",
"229694328961901355156115612056634361253",
"215689255696349223378395526426314181777",
"143636315560952745453981435542081564905",
"277732564169362208927961267864321768727",
"186802482126161271126476162382109598600",
"152457233170629562880967362894323228534",
"302854400340853149036966151597928312361",
"245759460958062258893546067911878137509",
"174120382879972429160282823612655242720",
"179240761063923681412823779630710328993",
"56783227838309711292418830894332671352",
"321924372463835375804607855746703744259",
"255926694621379865635632663948107000136",
"153356795560776817648989146904732361328",
"328157110284421163395166231549752699472",
"128011503187951768054479910956781153091",
"14997039039774458871193866901783393243",
"243997219802485592358256925634576016308",
"236596537068076712472181463900416520651",
"102174861221127255194378833845150991491",
"287979288517239566299244475921222815993",
"296202915652744921405100257105764390010",
"247150939643836653841183791585942424054",
"28573403460033843666455703446302828096",
"306965828449882128427334663706805693122",
"20069288531270529332384677086161229305",
"220414389342487878076685681929913986398",
"328248477993612886340354615983913366192",
"284445912050110576761304320320616747742",
"298588001092170811727309392177169997410",
"125995880315864881469573225205568883976",
"220324646755596423674531789955350532656",
"214155661553625801673301030682456642760",
"205013673944664016148626822131574762870",
"210327947657813045929633275006293052214",
"20069288531270529332384677086161229305",
"290973803499210229732759046981798738565",
"125995880315864881469573225205568883976",
"225105303296761758330575627004320550960",
"328157110284421163395166231549752699472",
"128011503187951768054479910956781153091",
"125187358286663956617226779219914237298",
"174315971198274478358783076089725889330",
"160040418584245929232890342845015769766",
"26270294137273845852341519625739581760",
"287979288517239566299244475921222815993",
"60921811147382253802598517762587807154",
"144451143742804563505449256426308352256",
"206021246924141086623802736377337495395",
"131540090325553696013702860823301096382",
"318792628919797016999672209022427031831",
"72892350191242648116391809768417889986",
"146927875959045420445258450387454530838",
"188557575712349955984031320441624093571",
"108572714219283274013254993336862100158",
"128011503187951768054479910956781153091",
"31051112002560498441247918079341541535",
"75407180318704451699303769443305508093",
"272603350525009630618136922483563968064",
"162746661378333926093609331049803773936"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/cc4ac341f29fa368da6ef01c207deaf8c61f6a2e",
"target": {
"file": "coders/cut.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-16642-954403d1",
"digest": {
"length": 3133,
"function_hash": "90115647829160301438588756295225745046"
},
"source": "https://github.com/imagemagick/imagemagick/commit/cc4ac341f29fa368da6ef01c207deaf8c61f6a2e",
"target": {
"file": "coders/cut.c",
"function": "InsertRow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:21:24Z"
}
}
],
"modified": "2026-10-24T14:21:24.486352117Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html",
"https://usn.ubuntu.com/3785-1/",
"https://www.debian.org/security/2018/dsa-4316",
"https://github.com/ImageMagick/ImageMagick/commit/cc4ac341f29fa368da6ef01c207deaf8c61f6a2e",
"https://github.com/ImageMagick/ImageMagick/issues/1162"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:7.0.7-37:*:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"introduced": "7.0.7-37"
},
{
"last_affected": "7.0.7-37"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-16642",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443651,
"published_at": "2018-09-06T22:29:00.88+00:00"
}