The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2016-7997.json"