An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility.

Published 9 y ago 2016-12-23 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

3.8%

percentile 90%

Public exploits

none known

An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality.

Exploit prediction (EPSS)

3.78% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.5	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
CNA	3.0	7.5	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

n/a ImageMagick 7.0.3-1

Classification

Weakness

CWE-787 Out-of-bounds Write

References

securityfocus.com /bid/94727 · vdb-entry, x_refsource_BID, x_transferred
debian.org /security/2017/dsa-3799 · vendor-advisory, x_refsource_DEBIAN, x_transferred
talosintelligence.com /reports/TALOS-2016-0216/ · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2016-8707
NVD: CVE-2016-8707

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.