Critical
Security advisory
The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-4564
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:19 UTC · Revision 1
Source evidence
The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
osv:CVE-2016-4564
Complete source record
{
"id": "789c39cd1194f731bc1634a86786155346c65e4aac1d859b61d116b64413a80d",
"url": "https://osv.dev/vulnerability/CVE-2016-4564",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-4564",
"summary": "The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.",
"evidence": "osv:CVE-2016-4564",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-4564",
"aliases": [
"CVE-2016-4564"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick",
"type": "GIT",
"events": [
{
"introduced": "e46b7d19de7914881986ef939f690facc7a0198d"
},
{
"last_affected": "044a9bc056a8e0a7979009b41901e97640626257"
},
{
"fixed": "726812fa2fa7ce16bcf58f6e115f65427a1c0950"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-0"
},
{
"last_affected": "7.0.1-0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1-1"
},
{
"last_affected": "7.0.1-1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "726812fa2fa7ce16bcf58f6e115f65427a1c0950"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"7.0.1-0",
"7.0.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4564.json",
"vanir_signatures": [
{
"id": "CVE-2016-4564-0769ef42",
"digest": {
"length": 10540,
"function_hash": "19087062209882581044641411060786551904"
},
"source": "https://github.com/imagemagick/imagemagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950",
"target": {
"file": "MagickCore/draw.c",
"function": "TraceStrokePolygon"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-4564-890e239d",
"digest": {
"length": 3488,
"function_hash": "199412975228909332613035562347786452244"
},
"source": "https://github.com/imagemagick/imagemagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950",
"target": {
"file": "MagickCore/draw.c",
"function": "GetDrawInfo"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-4564-a451aa3a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335925560134690317193092292346148598978",
"307948842438111121134376582141792796824",
"97345539009483171584076736458940709996",
"64898305418218442766827821520648203195",
"39912305942279437731012210379761251617",
"40443501656162150355495403035712924760",
"73770472470587632883798795161565020304",
"108226680772346091687868864400085679842",
"123500761471490265105147971528166897161",
"128911744063364514777923767508840543425",
"52330198588996416451826398963021301631",
"39155747152746986153251298903565164589",
"263893698248966395428460961874113703311",
"222972072724161323662315619050432438047",
"37872776098310485081149520352596256823",
"87766492829804867606755861836032755714",
"318812137520032918497578210276177144452",
"285519679534823872783653649443451620369",
"111664113479720381242873764103512901456",
"209105006954348787744956521427701845128",
"86994817891360412057289853076436632576",
"282816159401390604297193423431513401052",
"263960042071451048902034245583640204662",
"107173512466735287013316648176502235637",
"176276748335204020322126314289568947720",
"282816159401390604297193423431513401052",
"263960042071451048902034245583640204662",
"107173512466735287013316648176502235637",
"310828230740712513599460023578692140619",
"31749063765810394033456734707565040366",
"66603185189968205733053196986599662754",
"149118458899116707934837996113363284337",
"10266813249376292710459755104441149012",
"260728227847294758935892291231482334031",
"183014658586905284531964200868872214974",
"176631909759406139029928140274926783744",
"308642993537714985887596125408117446631",
"248624470573473206926966028792723341877",
"44017432680821659120688356788415541818",
"13513726291783741092497127189136216081",
"219005237784560473002689149717526593856",
"16920365415131233757724635579526988406",
"336064720220418584245076687232359569712",
"91759784730048765921748842399854390431",
"173447169806335433436180807977390116521",
"141063037036872547953980132765050672364",
"159035688460192567075543989008746304701",
"216176733096076452748713191831734300187",
"69415229704931832362455333872666459402",
"147167426969163165536624855055937205817",
"175753101143168695242006631749909177644",
"143670045905339725661114794419022984854",
"158615013654191673580989709297953542361",
"82680078655929986894877045897422248313"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950",
"target": {
"file": "MagickCore/draw.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-4564-a7899e3b",
"digest": {
"length": 3350,
"function_hash": "25757192401322138830226923066754159931"
},
"source": "https://github.com/imagemagick/imagemagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950",
"target": {
"file": "MagickCore/draw.c",
"function": "DrawDashPolygon"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-4564-c0d05cd5",
"digest": {
"length": 33654,
"function_hash": "188218296422400481329023041470426665333"
},
"source": "https://github.com/imagemagick/imagemagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950",
"target": {
"file": "MagickCore/draw.c",
"function": "DrawImage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:12:08Z"
}
}
],
"modified": "2026-10-24T14:12:08.172119845Z",
"provider": "osv",
"references": [
"https://github.com/ImageMagick/ImageMagick/commit/726812fa2fa7ce16bcf58f6e115f65427a1c0950"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"last_affected": "6.9.3-0"
},
{
"last_affected": "6.9.3-0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*",
"cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:*:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0-0"
},
{
"last_affected": "7.0.0-0"
},
{
"introduced": "7.0.0-0"
},
{
"last_affected": "7.0.0-0"
},
{
"introduced": "7.0.1-0"
},
{
"last_affected": "7.0.1-0"
},
{
"introduced": "7.0.1-1"
},
{
"last_affected": "7.0.1-1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-4564",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443332,
"published_at": "2016-06-04T16:59:02.563+00:00"
}