CVE-2016-3714
ImageMagick Improper Input Validation Vulnerability
Published May 5, 2016 · updated Jun 16, 2026 · imagemagick imagemagick
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Timeline
Detection, updates, and resolution for this record.
May 5, 2016 · Catalog
Detected
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Sep 9, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Sep 30, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Sep 30, 2024
Affected
- cpe canonical/ubuntu linux12.04
- cpe canonical/ubuntu linux14.04
- cpe canonical/ubuntu linux15.10
- cpe canonical/ubuntu linux16.04
- cpe debian/debian linux8.0
- cpe imagemagick/imagemagickversion unspecified
- cpe imagemagick/imagemagick7.0.0-0
- cpe imagemagick/imagemagick7.0.1-0
- vendor ImageMagick ImageMagickversion unspecified
Sources
- CISA KEVCVE-2016-3714
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
cisa.gov - CVE.orgCVE-2016-3714
Official CVE identifier
cve.org - FIRST EPSSCVE-2016-3714
30-day exploitation probability 97.5%
first.org - Exploit Database39767
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database39791
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_unix/fileformat/imagemagick_delegate
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2016-3714
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
nvd.nist.gov