{"id":"CVE-2016-3714","kind":"vulnerability","aliases":["CVE-2016-3714"],"related":[],"title":"The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick…","description":"ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"ImageMagick's coder handling for several formats (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) does not validate input, so shell metacharacters in a crafted image are passed to a shell. A remote attacker who gets a crafted image processed can execute arbitrary code on the server.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-09-09T00:00:00+00:00","products":[{"name":"ImageMagick ImageMagick","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"imagemagick","fixed":[],"affected":"<= 6.9.3-9","ecosystem":"vendor"},{"name":"imagemagick","fixed":[],"affected":"= 7.0.0-0","ecosystem":"vendor"},{"name":"imagemagick","fixed":[],"affected":"= 7.0.1-0","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 12.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 14.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 15.10","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 16.04","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"opensuse leap","fixed":[],"affected":"= 42.1","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 13.2","ecosystem":"vendor"},{"name":"suse linux enterprise server","fixed":[],"affected":"= 12","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","image-processing","imagemagick","package","self-hosted","web-upload"],"not_affected_if":["coders-disabled-in-policy","no-untrusted-image-input"],"how_to_check":"Check whether ImageMagick is installed and which version: convert -version or magick -version.\nCheck whether the policy file restricts these coders: grep -i 'coder' /etc/ImageMagick-*/policy.xml (unknown whether this is the only mitigation).","fix":"Apply the vendor mitigation: restrict the affected coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) in policy.xml, or upgrade to a fixed ImageMagick release (unknown which version; sources do not say).\nOtherwise stop processing untrusted images with ImageMagick.","status":"open","published_at":"2016-05-05T18:59:03+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:15+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:58:15Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation: restrict the affected coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) in policy.xml, or upgrade to a fixed ImageMagick release (unknown which version; sources do not say).\nOtherwise stop processing untrusted images with ImageMagick.","reach":"internet","impact":"high","summary":"ImageMagick's coder handling for several formats (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) does not validate input, so shell metacharacters in a crafted image are passed to a shell. A remote attacker who gets a crafted image processed can execute arbitrary code on the server.","category":"package","who_cares":["imagemagick","self-hosted","image-processing","web-upload"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the server processing the image","analyst_note":"Confirm affected and fixed ImageMagick versions and the exact policy.xml mitigation from the vendor advisory (CISA KEV lists it as exploited in the wild).","how_to_check":"Check whether ImageMagick is installed and which version: convert -version or magick -version.\nCheck whether the policy file restricts these coders: grep -i 'coder' /etc/ImageMagick-*/policy.xml (unknown whether this is the only mitigation).\nUnknown whether a specific version range is affected; sources do not list affected versions.","needs_analyst":true,"not_affected_if":["no-untrusted-image-input","coders-disabled-in-policy"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000592,"input_tokens":2865,"output_tokens":610,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':23A,26A '-3714':24A,27A '1':2A '2':4A '3':6A '4':8A '5':10A '6':12A '7':14A '8':17A 'action':153C 'affect':123C 'allow':136C 'appli':154C 'arbitrari':110B,142C 'attack':101B,139C 'canonical':33A,36A,39A,42A 'cisa':151C 'code':111B,143C 'coder':19A,70B,134C 'contain':116C 'craft':92B,105B,149C 'cve':22A,25A 'debian':45A,47A 'discontinu':160C 'enterprise':54A 'ephemer':3A,75B,125C 'execut':109B,141C 'exploit':56B 'format':74B 'get':103B 'handl':71B 'host':64B 'https':5A,76B,126C 'imag':58B,93B,106B,150C 'image-process':57B 'imagemagick':21A,28A,29A,30A,31A,32A,60B,68B,115C 'improp':118C 'input':86B,119C 'instruct':158C 'leap':50A 'linux':35A,38A,41A,44A,46A,48A,53A 'metacharact':89B,146C 'mitig':155C,166C 'msl':9A,78B,128C 'mvg':7A,77B,127C 'opensuse':49A,51A 'packag':61B 'pass':95B 'per':156C 'plt':18A,82B,133C 'process':59B,107B 'product':164C 'remot':100B,138C 'requir':152C 'self':63B 'self-host':62B 'server':55A,114B 'sever':73B 'shell':88B,98B,145C 'show':13A,80B,130C 'suse':52A 'text':11A,79B,129C 'ubuntu':34A,37A,40A,43A 'unavail':168C 'upload':67B 'use':161C 'valid':85B,120C 'vendor':157C 'via':144C 'vulner':121C 'web':66B 'web-upload':65B 'win':15A,81B,131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-05-05T18:59:03+00:00","kev":{"dateAdded":"2024-09-09","dueDate":"2024-09-30","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-3714","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3714","severity":null,"published_at":"2024-09-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-3714","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3714","severity":null,"published_at":"2016-05-05T18:59:03+00:00","modified_at":"2026-06-17T00:46:14+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}