CVE-2016-3714

KEVImageMagick Improper Input Validation Vulnerability

Description

ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedMay 5, 2016

Last modifiedJun 17, 2026

Added to KEVSep 9, 2024

Remediation dueSep 30, 2024

References

git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLogPatch
lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlThird Party Advisory
packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.htmlThird Party AdvisoryVDB Entry
rhn.redhat.com/errata/RHSA-2016-0726.htmlThird Party Advisory
debian.org/security/2016/dsa-3580Third Party Advisory
debian.org/security/2016/dsa-3746Third Party Advisory
openwall.com/lists/oss-security/2016/05/03/13Mailing List

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 756 days
CVSS: 8.4 HIGH
EPSS (30-day exploit probability): 97.5% · top 1% of all CVEs
Weakness: CWE-20
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.