---
id: "CVE-2016-3714"
kind: "vulnerability"
aliases: ["CVE-2016-3714"]
title: "The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "ImageMagick ImageMagick", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "imagemagick", "fixed": [], "affected": "<= 6.9.3-9", "ecosystem": "vendor"}, {"name": "imagemagick", "fixed": [], "affected": "= 7.0.0-0", "ecosystem": "vendor"}, {"name": "imagemagick", "fixed": [], "affected": "= 7.0.1-0", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 12.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 14.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 15.10", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 16.04", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "opensuse leap", "fixed": [], "affected": "= 42.1", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 13.2", "ecosystem": "vendor"}, {"name": "suse linux enterprise server", "fixed": [], "affected": "= 12", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "image-processing", "imagemagick", "package", "self-hosted", "web-upload"]
not_affected_if: ["coders-disabled-in-policy", "no-untrusted-image-input"]
published_at: "2016-05-05T18:59:03+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3714", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3714", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick…

ImageMagick's coder handling for several formats (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) does not validate input, so shell metacharacters in a crafted image are passed to a shell. A remote attacker who gets a crafted image processed can execute arbitrary code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ImageMagick ImageMagick affected ? fixed ?
- vendor:imagemagick affected <= 6.9.3-9 fixed ?
- vendor:imagemagick affected = 7.0.0-0 fixed ?
- vendor:imagemagick affected = 7.0.1-0 fixed ?
- vendor:canonical ubuntu linux affected = 12.04 fixed ?
- vendor:canonical ubuntu linux affected = 14.04 fixed ?
- vendor:canonical ubuntu linux affected = 15.10 fixed ?
- vendor:canonical ubuntu linux affected = 16.04 fixed ?
- vendor:debian linux affected = 8.0 fixed ?
- vendor:debian linux affected = 9.0 fixed ?
- vendor:opensuse leap affected = 42.1 fixed ?
- vendor:opensuse affected = 13.2 fixed ?
- vendor:suse linux enterprise server affected = 12 fixed ?

## How to check

Check whether ImageMagick is installed and which version: convert -version or magick -version.
Check whether the policy file restricts these coders: grep -i 'coder' /etc/ImageMagick-*/policy.xml (unknown whether this is the only mitigation).

## Fix

Apply the vendor mitigation: restrict the affected coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) in policy.xml, or upgrade to a fixed ImageMagick release (unknown which version; sources do not say).
Otherwise stop processing untrusted images with ImageMagick.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3714
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-3714

## From the sources

ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_