CVE-2016-3714

UNKNOWN

Published 2016-05-05T18:00:00.000Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2016-3714. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

8.4

/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.939

probability

of exploitation in the wild

There is a 93.9% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 0.999

Higher than 99.9% of all CVEs

Attack Vector Metrics

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Impact Metrics

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Description

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

imagemagick

Affected Versions:

imagemagick

Affected Versions:

7.0.0-0

imagemagick

Affected Versions:

7.0.1-0

canonical

ubuntu_linux

Affected Versions:

12.04 14.04 15.10 16.04

canonical

ubuntu_linux

Affected Versions:

12.04 14.04 15.10 16.04

canonical

ubuntu_linux

Affected Versions:

12.04 14.04 15.10 16.04

canonical

ubuntu_linux

Affected Versions:

12.04 14.04 15.10 16.04

debian

debian_linux

Affected Versions:

8.0 9.0

debian

debian_linux

Affected Versions:

8.0 9.0

opensuse

Affected Versions:

13.2

opensuse

leap

Affected Versions:

42.1

suse

suse_linux_enterprise_server

Affected Versions:

Known Exploited Vulnerability

This vulnerability is actively being exploited in the wild

View KEV Details

Remediation Status

Overdue

Due Date

September 30, 2024

Added to KEV

September 9, 2024

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Product

Vendor/Project: ImageMagick

Product: ImageMagick

Ransomware Risk

Known Ransomware Use

KEV Catalog Version: 2025.01.24 Released: January 24, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-24cp-26gx-3pp4

Advisory Details

CVSS Scoring

CVSS Score

7.5

CVSS Vector


                                    CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2016-3714

WEB https://access.redhat.com/errata/RHSA-2016:0726

WEB https://access.redhat.com/security/cve/CVE-2016-3714

WEB https://access.redhat.com/security/vulnerabilities/2296071

WEB https://bugzilla.redhat.com/show_bug.cgi?id=1332492

WEB https://imagetragick.com

WEB https://security.gentoo.org/glsa/201611-21

WEB https://www.exploit-db.com/exploits/39767

WEB https://www.exploit-db.com/exploits/39791

WEB https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588

WEB https://www.imagemagick.org/script/changelog.php

WEB https://www.kb.cert.org/vuls/id/250519

WEB http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog

WEB http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html

WEB http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html

WEB http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html

WEB http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html

WEB http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html

WEB http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html

WEB http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html

WEB http://rhn.redhat.com/errata/RHSA-2016-0726.html

WEB http://www.debian.org/security/2016/dsa-3580

WEB http://www.debian.org/security/2016/dsa-3746

WEB http://www.openwall.com/lists/oss-security/2016/05/03/13

WEB http://www.openwall.com/lists/oss-security/2016/05/03/18

WEB http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

WEB http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

WEB http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate

WEB http://www.securityfocus.com/archive/1/538378/100/0/threaded

WEB http://www.securityfocus.com/bid/89848

WEB http://www.securitytracker.com/id/1035742

WEB http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568

WEB http://www.ubuntu.com/usn/USN-2990-1

Advisory provided by GitHub Security Advisory Database. Published: May 14, 2022, Modified: September 9, 2024

References

https://access.redhat.com/security/vulnerabilities/2296071

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html

http://www.securitytracker.com/id/1035742

https://imagetragick.com/

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588

http://www.openwall.com/lists/oss-security/2016/05/03/13

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html

http://www.ubuntu.com/usn/USN-2990-1

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html

http://www.securityfocus.com/archive/1/538378/100/0/threaded

https://www.exploit-db.com/exploits/39767/

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html

http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

http://www.openwall.com/lists/oss-security/2016/05/03/18

http://www.debian.org/security/2016/dsa-3746

https://security.gentoo.org/glsa/201611-21

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568

https://www.imagemagick.org/script/changelog.php

https://www.exploit-db.com/exploits/39791/

http://www.debian.org/security/2016/dsa-3580

http://www.securityfocus.com/bid/89848

http://rhn.redhat.com/errata/RHSA-2016-0726.html

https://bugzilla.redhat.com/show_bug.cgi?id=1332492

https://www.kb.cert.org/vuls/id/250519

http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html

Published: 2016-05-05T18:00:00.000Z

Last Modified: 2025-07-30T01:46:38.542Z

Copied to clipboard!

CVE-2016-3714

Expert Analysis

CVSS Score

EPSS Score

Attack Vector Metrics

Impact Metrics

Description

Available Exploits

Related News

Affected Products

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Affected Versions:

Known Exploited Vulnerability

Remediation Status

Due Date

Added to KEV

Required Action

Affected Product

Ransomware Risk

GitHub Security Advisories

Advisory Details

CVSS Scoring

CVSS Score

CVSS Vector

References

References

Request Analysis

What to expect

Request Received!