CVE-2016-5118: GraphicsMagick and ImageMagick OpenBlob pipe filename command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 3.1 base score is 9.8 with network reachability, no privileges and no user interaction, and EPSS is near the top percentile, so unpatched exposure is severe.

What it is

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and in ImageMagick mishandles a pipe character at the start of a filename, allowing remote attackers to execute arbitrary code. Because image processing libraries are commonly fed untrusted files by web applications and services, this flaw exposes any such deployment to remote code execution.

Impact

An attacker gains arbitrary code execution with the privileges of the process handling the crafted filename, which can lead to full host compromise depending on how the image library is invoked.

Attack surface

Reached over the network by supplying a crafted filename beginning with a pipe character to an application that passes it to the affected library; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.50 (98.8th percentile), and references include vendor advisories and release notes rather than public exploit tags.

What to do

• Upgrade GraphicsMagick to 1.3.24 or later and apply the corresponding ImageMagick fix from the vendor commit.
• Apply distribution security updates (Debian DSA-3591/DSA-3746, Ubuntu USN-2990-1, openSUSE, Red Hat RHSA-2016:1237, Oracle, Slackware) for all affected packages.
• Sanitize or reject filenames containing a leading pipe character before passing them to image processing libraries, and avoid passing user-controlled strings as filenames.
• Run image processing in a sandboxed, low-privilege process with restricted filesystem and network access to limit the impact of code execution.

Detection

• Monitor process creation for shell or command interpreters spawned as children of image processing services.
• Alert on filenames or arguments beginning with a pipe character reaching image library calls in application logs or audit trails.
• Watch for unexpected outbound network connections or file writes originating from image conversion processes.
• Audit hosts for GraphicsMagick versions below 1.3.24 and unpatched ImageMagick packages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.