CVE-2016-5688
ImageMagick: Heap overflow and random invalid memory writes in WPg parser
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · June 14, 2016
Updated · November 21, 2025
Description
The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 5.8AV:N/AC:M/Au:N/C:N/I:P/A:P
CWE-122 · Heap-based Buffer Overflow