Vulnerability Spotlight: Image Magick Convert Tiff Out of Bounds Write
Summary: Cisco Talos disclosed TALOS-2016-0216 / CVE-2016-8707, an out of bounds write vulnerability in ImageMagick's bundled convert utility, which parses and converts image formats. The flaw occurs when deflating an Adobe Deflate compressed Tiff image: the buffer created to hold the decompressed data is too small for the decompressed stream, producing a controlled out of bounds write that under proper circumstances could be exploited into full remote code execution.
Key Takeaway: The bug sits in a utility used to convert images between formats, and Talos states the write is controlled and could be developed into full remote code execution - so any pipeline that hands untrusted Tiff files to convert is exposed. Talos published Snort rules 40914-40915 to detect exploitation attempts, noting additional rules may follow.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2016-8707
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026