# CVE-2016-7997: GraphicsMagick NULL pointer dereference in WPG reader

Source: https://junglewise.ai/threats/cve-2016-7997-graphicsmagick-null-pointer-dereference-in-wpg-reader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7997 · Severity: high · CVSS 7.5 · Published 2017-01-18

GraphicsMagick, a widely used image processing library, contains a flaw in how it handles WPG image files. An attacker can provide a specially crafted image that causes the software to crash, leading to a denial of service. This could disrupt business operations for any service that automatically processes user-uploaded images.

Technologies: [Graphicsmagick](https://junglewise.ai/threats/technologies/graphicsmagick). Vendors: [Graphicsmagick](https://junglewise.ai/threats/vendors/graphicsmagick).

## Quick answers

**Is CVE-2016-7997 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7997 being exploited in the wild.

**How severe is CVE-2016-7997?** High severity, with a CVSS score of 7.5, published 18 January 2017.

**Which products and versions are affected?** GraphicsMagick Group GraphicsMagick 1.3.25 and earlier.

**Is there a fix for CVE-2016-7997?** A patch was published on 2016-12-24: Debian released security update DSA-3746-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-7997 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-7997?** Check whether you run Graphicsmagick. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability exists in the WPG (WordPerfect Graphics) format reader of GraphicsMagick versions 1.3.25 and earlier. The issue is rooted in a logic error within the ReferenceBlob function where a NULL pointer is passed to a component that does not allow it, triggering an assertion failure. A remote attacker can exploit this by submitting a maliciously crafted WPG file for processing. Successful exploitation results in an immediate application crash (Denial of Service). This vulnerability was discovered via fuzzing with American Fuzzy Lop (AFL). Patches were made available in late 2016, with fixes included in Debian security updates and subsequent GraphicsMagick releases.

## Affected products

- GraphicsMagick Group GraphicsMagick 1.3.25 and earlier

## Timeline

- 2016-10-07: disclosed: Public disclosure on oss-security mailing list
- 2016-12-24: patched: Debian released security update DSA-3746-1
- 2017-01-18: advisory: NVD publication date

## References

- [http://www.debian.org/security/2016/dsa-3746](http://www.debian.org/security/2016/dsa-3746)
- [http://www.openwall.com/lists/oss-security/2016/10/07/4](http://www.openwall.com/lists/oss-security/2016/10/07/4)
- [http://www.openwall.com/lists/oss-security/2016/10/08/5](http://www.openwall.com/lists/oss-security/2016/10/08/5)
- [http://www.securityfocus.com/bid/93467](http://www.securityfocus.com/bid/93467)

## Related threats

- [GraphicsMagick uncontrolled recursion in WPG file handler](https://junglewise.ai/threats/cve-2026-103118-a-vulnerability-was-detected-in-graphicsmagick-up-to-1-3-47)
- [GraphicsMagick heap out-of-bounds write in PCD decoder](https://junglewise.ai/threats/cve-2026-77118-graphicsmagick-heap-out-of-bounds-write-in-pcd-decoder)
- [GraphicsMagick heap overflow in WPG format reader](https://junglewise.ai/threats/cve-2016-7996-graphicsmagick-heap-overflow-in-wpg-format-reader)