8.4 High Exploited

CVE-2016-3714 ImageMagick Improper Input Validation Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-20

Description

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Affected products and versions

Product	Affected versions	Fixed in
n/a	Versions not published
ImageMagick	7.0.1-0	No fix stated
ubuntu_linux	16.04	No fix stated
ubuntu_linux	15.10	No fix stated
ubuntu_linux	14.04	No fix stated
ubuntu_linux	12.04	No fix stated
debian_linux	9.0	No fix stated
debian_linux	8.0	No fix stated
opensuse	13.2	No fix stated

Show the 2 other branches

Product	Affected versions	Fixed in
Leap	42.1	No fix stated
suse_linux_enterprise_server	12	No fix stated

References

access.redhat.com access.redhat.com
git.imagemagick.org git.imagemagick.org
openSUSE-SU-2016:1266 lists.opensuse.org
1035742 www.securitytracker.com
imagetragick.com imagetragick.com
www.oracle.com www.oracle.com
www.imagemagick.org www.imagemagick.org
[oss-security] 20160503 ImageMagick Is On Fire -- CVE-2016-3714 www.openwall.com
SUSE-SU-2016:1301 lists.opensuse.org
openSUSE-SU-2016:1326 lists.opensuse.org
USN-2990-1 www.ubuntu.com
openSUSE-SU-2016:1261 lists.opensuse.org
20160513 May 2016 - HipChat Server - Critical Security Advisory www.securityfocus.com
39767 www.exploit-db.com
SUSE-SU-2016:1260 lists.opensuse.org
www.rapid7.com www.rapid7.com
www.oracle.com www.oracle.com
[oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714 www.openwall.com
DSA-3746 www.debian.org
GLSA-201611-21 security.gentoo.org
SUSE-SU-2016:1275 lists.opensuse.org
SSA:2016-132-01 www.slackware.com
www.imagemagick.org www.imagemagick.org
39791 www.exploit-db.com
DSA-3580 www.debian.org
89848 www.securityfocus.com
RHSA-2016:0726 rhn.redhat.com
bugzilla.redhat.com bugzilla.redhat.com
VU#250519 www.kb.cert.org
packetstormsecurity.com packetstormsecurity.com

Timeline

Published May 5, 2016
Added to the KEV catalogue September 9, 2024
Last modified October 21, 2025

The 144658 CVEs of n/a →

CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Not rated CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Not rated CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Not rated CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Not rated

Track this CVE