# CVE-2016-7996: GraphicsMagick heap overflow in WPG format reader

Source: https://junglewise.ai/threats/cve-2016-7996-graphicsmagick-heap-overflow-in-wpg-format-reader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7996 · Severity: critical · CVSS 9.8 · Published 2017-01-18

GraphicsMagick, a widely used image processing library, contains a vulnerability in how it handles WPG image files. By providing a specially crafted image file with an oversized colormap, an attacker can cause the application to crash or potentially execute unauthorized code. This could lead to service outages or the compromise of systems that automatically process user-uploaded images.

Technologies: [Graphicsmagick](https://junglewise.ai/threats/technologies/graphicsmagick). Vendors: [Graphicsmagick](https://junglewise.ai/threats/vendors/graphicsmagick).

## Quick answers

**Is CVE-2016-7996 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7996 being exploited in the wild.

**How severe is CVE-2016-7996?** Critical severity, with a CVSS score of 9.8, published 18 January 2017.

**Which products and versions are affected?** GraphicsMagick GraphicsMagick 1.3.25 and earlier.

**Is there a fix for CVE-2016-7996?** A patch was published on 2016-12-24: Debian released security update DSA-3746-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-7996 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-7996?** Check whether you run Graphicsmagick. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the WPG (WordPerfect Graphics) format reader of GraphicsMagick versions 1.3.25 and earlier. The vulnerability is rooted in a lack of bounds checking for colormap entries when the library is built with the default QuantumDepth=8 configuration. An attacker can exploit this by providing a WPG file containing a colormap with more than 256 entries, leading to a heap overflow. This can result in a crash (denial of service) or potentially remote code execution. The issue has been addressed in Debian security updates and subsequent GraphicsMagick releases.

## Affected products

- GraphicsMagick GraphicsMagick 1.3.25 and earlier

## Timeline

- 2016-10-07: disclosed: Vulnerability disclosed on oss-security mailing list
- 2016-12-24: patched: Debian released security update DSA-3746-1
- 2017-01-18: advisory: NVD published CVE-2016-7996 details

## References

- [http://www.debian.org/security/2016/dsa-3746](http://www.debian.org/security/2016/dsa-3746)
- [http://www.openwall.com/lists/oss-security/2016/10/07/4](http://www.openwall.com/lists/oss-security/2016/10/07/4)
- [http://www.openwall.com/lists/oss-security/2016/10/08/5](http://www.openwall.com/lists/oss-security/2016/10/08/5)
- [http://www.securityfocus.com/bid/93464](http://www.securityfocus.com/bid/93464)

## Related threats

- [GraphicsMagick uncontrolled recursion in WPG file handler](https://junglewise.ai/threats/cve-2026-103118-a-vulnerability-was-detected-in-graphicsmagick-up-to-1-3-47)
- [GraphicsMagick heap out-of-bounds write in PCD decoder](https://junglewise.ai/threats/cve-2026-77118-graphicsmagick-heap-out-of-bounds-write-in-pcd-decoder)
- [GraphicsMagick NULL pointer dereference in WPG reader](https://junglewise.ai/threats/cve-2016-7997-graphicsmagick-null-pointer-dereference-in-wpg-reader)