CVE-2016-3714: ImageMagick Improper Input Validation Vulnerability

CVSS: 10.0v2.0HighKEVAnalyzed

AliasesSUSE-SU-2016:1301-1UBUNTU-CVE-2016-3714DEBIAN-CVE-2016-3714

Published 05-05-2016Last modified 21-10-2025

Vulnerability summary

CVE-2016-3714 is a high (CVSS 10.0) Improper Input Validation vulnerability in ImageMagick. It is known to be exploited: CISA lists it, first on 09-09-2024. EPSS estimates a 97.48% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

97.48%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits3exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 13 · Related 7

DLA-484-1 DLA-486-1 DSA-3580-1 DSA-3746-1 MGASA-2016-0188 OPENSUSE-SU-2024:10040-1+7 more

Timeline

05-05-2016
PublishedVulnerability first disclosed.
09-09-2024
Added to CISA KEVImageMagick Improper Input Validation Vulnerability
30-09-2024
CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
21-10-2025
Last modifiedVulnerability information updated.

Description

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

CVSS metrics

6 scores · 4 sources · 3 versions

v3.18.4v3.08.4v2.010.0

EPSS trend

Probability

97.48%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 97.48% on 18-09-2026

18-09-202618-10-2026

EPSS score

97.48%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 09-09-2024
Federal due date: 30-09-2024

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2016-3714

Public exploits

3 found

exploit-databasedosmultipleUnverified
ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities
Maturity: poc
exploit-databaselocalmultipleVerified
ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
ImageMagick Delegate Arbitrary Command Execution
exploit/unix/fileformat/imagemagick_delegate
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Suse10 products

ImageMagick&distro=SUSE Linux Enterprise Server 11 SP2-LTSS< 6.4.3.6-7.37.1
ImageMagick&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 6.4.3.6-7.37.1
ImageMagick&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA< 6.4.3.6-7.37.1
ImageMagick&distro=SUSE Linux Enterprise Server 11 SP4< 6.4.3.6-7.37.1
ImageMagick&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 6.4.3.6-7.37.1

Show all 10

Debian3 products

graphicsmagick< 1.3.24-1
imagemagick< 8:6.9.6.2+dfsg-2
debian_linuxEOL8.0 | 9.0

Opensuse2 products

leapEOL42.1
opensuseEOL13.2

Ubuntu2 products

graphicsmagick< 1.3.18-1ubuntu3.1 | < 1.3.23-1ubuntu0.1
imagemagick< 8:6.7.7.10-6ubuntu3.1 | < 8:6.8.9.9-7ubuntu5.1

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 15.10 | 16.04

Imagemagick1 product

imagemagick≤ 6.9.3-9 | 7.0.0-0 | 7.0.1-0

6 vendors · 19 products

References

41 links

access.redhat.com/security/vulnerabilities/2296071X Refsource CONFIRMThird Party Advisory
git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLogX Refsource CONFIRMPatch
lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.securitytracker.com/id/1035742VDB EntryX Refsource SECTRACKThird Party Advisory
imagetragick.comX Refsource MISCVendor Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlX Refsource CONFIRMThird Party Advisory
www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588X Refsource CONFIRMVendor Advisory
www.openwall.com/lists/oss-security/2016/05/03/13Mailing ListX Refsource MLIST
lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory

Show all 41 references

www.ubuntu.com/usn/USN-2990-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.securityfocus.com/archive/1/538378/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/39767/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegateX Refsource MISCThird Party Advisory
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlX Refsource CONFIRMThird Party Advisory
www.openwall.com/lists/oss-security/2016/05/03/18Mailing ListX Refsource MLISTREPORT
www.debian.org/security/2016/dsa-3746Vendor AdvisoryX Refsource DEBIANThird Party Advisory
security.gentoo.org/glsa/201611-21Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568Vendor AdvisoryX Refsource SLACKWAREThird Party Advisory
www.imagemagick.org/script/changelog.phpX Refsource CONFIRMVendor Advisory
www.exploit-db.com/exploits/39791/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.debian.org/security/2016/dsa-3580Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/89848VDB EntryX Refsource BIDThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-0726.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1332492X Refsource CONFIRMIssue Tracking
www.kb.cert.org/vuls/id/250519Third Party AdvisoryX Refsource CERT VNUS Government Resource
packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.htmlX Refsource MISCThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714Government ResourceUS Government Resource
www.suse.com/support/update/announcement/2016/suse-su-20161301-1/Advisory
bugzilla.suse.com/978061REPORT
www.suse.com/security/cve/CVE-2016-3714WEB
ubuntu.com/security/CVE-2016-3714REPORT
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-3714REPORT
www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588REPORT
ubuntu.com/security/notices/USN-2990-1Advisory
www.cve.org/CVERecord?id=CVE-2016-3714REPORT
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
security-tracker.debian.org/tracker/CVE-2016-3714Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities