VulnerabilityModified

CVE-2016-9298

Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.

MEDIUM 5.5EPSS 1.88%

Does this matter?

Lower severity and a low EPSS score (1.88%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 1.88% probability · 79th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-119
Affected: imagemagick/imagemagick
Source: cve@mitre.org

EPSS trend

EPSS moved from 3.1% on 21 September 2026 to 1.9% on 27 October 2026.

References

http://www.openwall.com/lists/oss-security/2016/11/13/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/14/10Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/94310Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/3cbfb163cff9e5b8cdeace8312e9bfee810ed02bIssue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/296Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201702-09
http://www.openwall.com/lists/oss-security/2016/11/13/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/14/10Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/94310Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/3cbfb163cff9e5b8cdeace8312e9bfee810ed02bIssue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/296Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201702-09

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.