CVE-2017-16545

What it actually does

The ReadWPGImage function in coders/wpg.c fails to validate colormapped WPG images, resulting in an invalid write via ImportIndexQuantumType that can crash the application or enable further memory corruption.

Why it matters to the business

Services relying on GraphicsMagick for image handling may experience sudden crashes or instability when encountering crafted WPG files, leading to operational disruptions and potential downtime for image-processing workflows.

How an attack unfolds

An attacker creates a malformed WPG image that bypasses colormap validation, then supplies the file to a target system where GraphicsMagick attempts to process it, triggering the invalid memory write.

How to fix it

Upgrade GraphicsMagick to a version that contains the fix for improper WPG colormap validation; if no fixed release is available, disable WPG support or restrict image processing to trusted sources.

How to confirm the fix worked

Confirm GraphicsMagick version is newer than 1.3.26, test processing of both benign and known-malformed WPG files to verify absence of crashes, and review source code or release notes for the validation fix.

Typical attack path

1. Create a specially crafted WPG image file containing invalid colormap data
2. Deliver the file to the victim through web upload, email attachment, or file share
3. Victim application invokes GraphicsMagick to read the WPG image
4. ReadWPGImage performs an out-of-bounds write and crashes or corrupts memory

How to detect it

Search application and system logs for GraphicsMagick crashes or segmentation faults occurring during WPG file processing; inspect core dumps or stack traces referencing ReadWPGImage or ImportIndexQuantumType.

What your security team should do

• Immediately upgrade GraphicsMagick to the latest available release
• Implement input validation or sandboxing around image-processing functions
• Block or quarantine WPG files from untrusted sources until patched
• Monitor application logs and crash reports for WPG-related failures