peter bassill · operator
$ cve CVE-2016-3714 JSON

CVE-2016-3714 KEV EXPLOIT

8.4
HIGH · CVSS 3.1 · EPSS 97.5% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2024-09-30.

Description

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Scoring

CVSS8.4 (HIGH, v3.1)
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS97.49% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-20
On CISA KEVyes — remediate by 2024-09-30
Public exploityes
Published2016-05-05
Last modified2026-06-17

CISA KEV

NameImageMagick Improper Input Validation Vulnerability
Added2024-09-09
Due2024-09-30
Vendor / productImageMagick / ImageMagick
Ransomware usenone reported

Affected (6)

VendorProduct
canonicalubuntu linux
debiandebian linux
imagemagickimagemagick
opensuseleap
opensuseopensuse
susesuse linux enterprise server

Public exploits

SourceTitleDate
exploit-dbImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit)2016-05-09
exploit-dbImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities2016-05-04

References

→ the Explorer  ·  watch your stack  ·  NVD