CVE-2016-3714

Confirmed PUBLISHED

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before...

ImageMagick · ImageMagick

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

8.4 High

At a Glance

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

windows nessus_scanner cisa

CVE Published: May 05, 2016
Exploitation Reported: Sep 09, 2024
CVSS: 8.4 High
EPSS: —

Low complexity No user interaction Unauthenticated

Affected Versions

27 version rows · page 1 of 2

Vendor	Product	Version	Status
imagemagick	imagemagick	0 to <= 6.9.3-9	Affected
imagemagick	imagemagick	7.0.0-0	Affected
imagemagick	imagemagick	7.0.1-0	Affected
canonical	ubuntu_linux	12.04	Affected
canonical	ubuntu_linux	14.04	Affected
canonical	ubuntu_linux	15.10	Affected
canonical	ubuntu_linux	16.04	Affected
canonical	ubuntu_linux	12.04	Affected
canonical	ubuntu_linux	14.04	Affected
canonical	ubuntu_linux	15.10	Affected
canonical	ubuntu_linux	16.04	Affected
canonical	ubuntu_linux	12.04	Affected
canonical	ubuntu_linux	14.04	Affected
canonical	ubuntu_linux	15.10	Affected
canonical	ubuntu_linux	16.04	Affected
canonical	ubuntu_linux	12.04	Affected
canonical	ubuntu_linux	14.04	Affected
canonical	ubuntu_linux	15.10	Affected
canonical	ubuntu_linux	16.04	Affected
debian	debian_linux	8.0	Affected
debian	debian_linux	9.0	Affected
debian	debian_linux	8.0	Affected
debian	debian_linux	9.0	Affected
opensuse	opensuse	13.2	Affected
opensuse	leap	42.1	Affected

CVE References

openSUSE-SU-2016:1266 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028...
SUSE-SU-2016:1301 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041...
openSUSE-SU-2016:1326 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051...
USN-2990-1 ubuntu.com · Vendor Advisory http://www.ubuntu.com/usn/USN-2990-1
openSUSE-SU-2016:1261 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025...

Show 25 more references

SUSE-SU-2016:1260 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024...
DSA-3746 debian.org · Vendor Advisory http://www.debian.org/security/2016/dsa-3746
GLSA-201611-21 security.gentoo.org · Vendor Advisory https://security.gentoo.org/glsa/201611-21
SUSE-SU-2016:1275 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032...
SSA:2016-132-01 slackware.com · Vendor Advisory http://www.slackware.com/security/viewer.php?l=slackware-security&y=2...
DSA-3580 debian.org · Vendor Advisory http://www.debian.org/security/2016/dsa-3580
RHSA-2016:0726 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0726.html
VU#250519 kb.cert.org · Third-Party Advisory https://www.kb.cert.org/vuls/id/250519
39767 exploit-db.com · Exploit https://www.exploit-db.com/exploits/39767/
39791 exploit-db.com · Exploit https://www.exploit-db.com/exploits/39791/
1035742 securitytracker.com · VDB Entry http://www.securitytracker.com/id/1035742
89848 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/89848
[oss-security] 20160503 ImageMagick Is On Fire -- CVE-2016-3714 openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2016/05/03/13
20160513 May 2016 - HipChat Server - Critical Security Advisory securityfocus.com · Mailing List http://www.securityfocus.com/archive/1/538378/100/0/threaded
[oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714 openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2016/05/03/18
access.redhat.com/security/vulnerabilities/2296071 access.redhat.com · CVE Record https://access.redhat.com/security/vulnerabilities/2296071
git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7... git.imagemagick.org · CVE Record http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cab...
imagetragick.com imagetragick.com · CVE Record https://imagetragick.com/
oracle.com/technetwork/topics/security/linuxbulletinapr... oracle.com · CVE Record http://www.oracle.com/technetwork/topics/security/linuxbulletinapr201...
imagemagick.org/discourse-server/viewtopic.php imagemagick.org · CVE Record https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
rapid7.com/db/modules/exploit/unix/fileformat/imagemagi... rapid7.com · CVE Record http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_...
oracle.com/technetwork/topics/security/bulletinjul2016-... oracle.com · CVE Record http://www.oracle.com/technetwork/topics/security/bulletinjul2016-309...
imagemagick.org/script/changelog.php imagemagick.org · CVE Record https://www.imagemagick.org/script/changelog.php
bugzilla.redhat.com/show_bug.cgi bugzilla.redhat.com · CVE Record https://bugzilla.redhat.com/show_bug.cgi?id=1332492
packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2024-09-09 00:00 UTC

CVSS Scores

CVSS v3.1 8.4 High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2024-09-09 00:00:00 UTC · CISA

Proof of concept available

Recorded 2016-05-04 09:47:42 UTC · GitHub

Weaknesses (CWE)

CWE-20

Improper Input Validation

Scanner Integrations

Scanner	Reference	Detected
Nessus	https://www.tenable.com/plugins/nessus/219582	Jun 02, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

JoshMorrison99/CVE-2016-3714

github · Created 2022-12-02 20:19:46 UTC · 1 stars

Hood3dRob1n/CVE-2016-3714

github · Created 2016-05-07 08:21:27 UTC · 69 stars

ImaegMagick Code Execution (CVE-2016-3714)

jpeanut/ImageTragick-CVE-2016-3714-RShell

github · Created 2016-05-05 18:16:52 UTC · 18 stars

chusiang/CVE-2016-3714.ansible.role

github · Created 2016-05-05 11:05:20 UTC · 1 stars

Fix ImageMagick Command Injection (CVE-2016-3714) with Ansible.

tommiionfire/CVE-2016-3714

github · Created 2016-05-04 09:47:42 UTC · 0 stars

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2016-3714

{
  "cve_id": "CVE-2016-3714",
  "title": "The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, ...",
  "affected_vendor": "ImageMagick",
  "affected_product": "ImageMagick",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 8.4,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2016-3714

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API