CVE-2016-3714
ImageMagick Improper Input Validation Vulnerability
Description
CVE-2016-3714, widely known as "ImageTragick," is a high-severity remote code execution vulnerability in ImageMagick versions prior to 6.9.3-10 and 7.x prior to 7.0.1-1. The flaw exists in multiple ImageMagick coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT) that fail to properly sanitize shell metacharacters in crafted image files, enabling remote attackers to execute arbitrary operating system commands. With an EPSS score of 93.7% (99.8th percentile), this vulnerability is among the most exploited flaws ever disclosed. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 30, 2024, underscoring its persistent threat to organizations running unpatched ImageMagick installations.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| imagemagick | imagemagick | <= 6.9.3-9; 7.0.0-0; 7.0.1-0 |
| canonical | ubuntu linux | 12.04; 14.04; 15.10; 16.04 |
| debian | debian linux | 8.0; 9.0 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 13.2 |
| suse | suse linux enterprise server | 12 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog(Patch)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html(Third Party Advisory)
- http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html(Third Party Advisory, VDB Entry)
- http://rhn.redhat.com/errata/RHSA-2016-0726.html(Third Party Advisory)
- http://www.debian.org/security/2016/dsa-3580(Third Party Advisory)
- http://www.debian.org/security/2016/dsa-3746(Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2016/05/03/13(Mailing List)
- http://www.openwall.com/lists/oss-security/2016/05/03/18(Mailing List)
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(Third Party Advisory)
- http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate(Third Party Advisory)
- http://www.securityfocus.com/archive/1/538378/100/0/threaded(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/89848(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1035742(Third Party Advisory, VDB Entry)
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568(Third Party Advisory)
- http://www.ubuntu.com/usn/USN-2990-1(Third Party Advisory)
- https://access.redhat.com/security/vulnerabilities/2296071(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=1332492(Issue Tracking)
- https://imagetragick.com/(Vendor Advisory)
- https://security.gentoo.org/glsa/201611-21(Third Party Advisory)
- https://www.exploit-db.com/exploits/39767/(Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/39791/(Third Party Advisory, VDB Entry)
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588(Vendor Advisory)
- https://www.imagemagick.org/script/changelog.php(Vendor Advisory)
- https://www.kb.cert.org/vuls/id/250519(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714(US Government Resource)
Weakness Type
OS Command Injection via Image Processing
Although no formal CWE has been assigned to CVE-2016-3714, the vulnerability is an OS command injection flaw triggered through image file processing. ImageMagick's delegate mechanism passes user-supplied filenames and URL parameters to external programs via shell commands without proper sanitization of special characters. When processing a maliciously crafted image file, shell metacharacters embedded in the image content or metadata are passed directly to the system shell, allowing arbitrary command execution. This is particularly insidious because the malicious payload is embedded within what appears to be a legitimate image file, bypassing many security controls that focus on executable file types.
Learn more: CWE-78: Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
The CVSS v3.1 base score of 8.4 (High) reflects a devastating vulnerability that requires no privileges and no network access in its most basic form — just the ability to submit a crafted image file for processing. Confidentiality (C:H), integrity (I:H), and availability (A:H) are all fully compromised, as the attacker achieves arbitrary command execution with the privileges of the ImageMagick process, which often runs as the web server user. The local attack vector (AV:L) in the CVSS score reflects the file-based nature of the attack, but in practice, ImageMagick is frequently invoked through web applications that accept image uploads, making remote exploitation trivially achievable.
From a business perspective, ImageMagick is one of the most widely deployed image processing libraries, used by countless web applications, content management systems, and image hosting platforms for thumbnail generation, format conversion, and image manipulation. A single malicious image upload can compromise the entire web server. The EPSS score of 93.7% at the 99.8th percentile places this among the most exploited vulnerabilities ever tracked — virtually guaranteed to face exploitation attempts. While the ransomware association is listed as unknown, the ability to execute arbitrary commands on web servers makes it suitable for any post-exploitation activity, from cryptocurrency mining to data exfiltration and ransomware deployment.
Exploit Maturity
CVE-2016-3714 (ImageTragick) has been one of the most widely exploited vulnerabilities since its disclosure in May 2016. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 30, 2024 — more than eight years after disclosure — confirming that exploitation remains active. The EPSS probability of 93.7% at the 99.8th percentile indicates near-certain exploitation activity, placing it in the top 0.2% of all tracked vulnerabilities.
Multiple public exploits are readily available: Rapid7 published a Metasploit module for automated exploitation, and exploit code is available on Exploit-DB (entries 39767 and 39791). The dedicated ImageTragick website provided detailed exploitation guidance immediately upon disclosure. The vulnerability's ease of exploitation — requiring only a crafted image file upload — and the ubiquity of ImageMagick in web application stacks have made it a favorite of automated exploitation frameworks, botnet operators, and APT groups alike. The ransomware classification is "Unknown," but the broad availability of exploit tooling and the web-facing attack surface make this a persistent threat.
Remediation
- Upgrade ImageMagick immediately — Update to ImageMagick 6.9.3-10 or later (for the 6.x branch) or 7.0.1-1 or later (for the 7.x branch). Use your distribution's package manager to install the latest available version, as all major Linux distributions have released patched packages.
- Implement an ImageMagick policy file — Configure
/etc/ImageMagick-6/policy.xml(or the equivalent for your version) to disable the vulnerable coders. Add policy entries to deny rights for the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This provides defense-in-depth even with patched versions. - Validate uploaded images before processing — Implement server-side validation that checks file magic bytes (not just file extensions) before passing files to ImageMagick. Use a whitelist approach, accepting only known-safe image formats such as PNG, JPEG, and GIF, and reject any files with unexpected content.
- Sandbox ImageMagick processes — Run ImageMagick in a sandboxed environment using containers, seccomp profiles, or dedicated processing workers with minimal filesystem and network access. This limits the damage if a new ImageMagick vulnerability is discovered.
- Consider alternative libraries — For simple image processing tasks (resizing, format conversion), evaluate replacing ImageMagick with more focused libraries such as libvips, Pillow (Python), or Sharp (Node.js) that have smaller attack surfaces and do not include the delegate functionality that enables this class of vulnerability.
Technical Details
The CVSS v3.1 vector for CVE-2016-3714 is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 8.4 (High). Attack Vector (AV:L) reflects the file-based nature of the attack, though web applications that accept image uploads effectively elevate this to network-accessible. Attack Complexity (AC:L) indicates trivial exploitation. Privileges Required (PR:N) means no authentication is needed — just the ability to submit an image for processing. User Interaction (UI:N) confirms no human action is needed beyond the automated image processing. Scope (S:U) limits the directly affected component. Confidentiality (C:H), Integrity (I:H), and Availability (A:H) reflect full system compromise.
ImageMagick uses a delegate mechanism to handle various image formats by invoking external programs through shell commands. The vulnerable coders — EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT — construct shell commands that include user-controlled parameters without proper sanitization. For example, a crafted MVG (Magick Vector Graphics) file can embed shell metacharacters in URL or filename references that are passed directly to /bin/sh. A minimal exploit payload can be as simple as an MVG file containing a url() directive with backtick-enclosed commands or pipe characters followed by shell commands. When ImageMagick processes this file — whether through command-line invocation, a web application's image upload handler, or an automated processing pipeline — the embedded commands execute with the privileges of the ImageMagick process. The ImageMagick changelog documents the fix that added proper input sanitization to the affected coders.
Frequently Asked Questions
What is CVE-2016-3714 (ImageTragick)?
CVE-2016-3714, nicknamed "ImageTragick," is a remote code execution vulnerability in the ImageMagick image processing library. It allows attackers to execute arbitrary operating system commands by crafting a malicious image file that exploits insufficient input sanitization in multiple ImageMagick coders. The vulnerability affects virtually any application that uses ImageMagick to process user-uploaded images.
Why is a 2016 vulnerability still being actively exploited?
ImageMagick is embedded in an enormous number of web applications, content management systems, and automated processing pipelines. Many of these installations are not regularly updated, and the vulnerability is trivially easy to exploit — requiring only a crafted image file. The availability of Metasploit modules and public exploit code makes it accessible to attackers of all skill levels.
How can I check if my system is vulnerable?
Run convert --version or magick --version to check your ImageMagick version. Versions prior to 6.9.3-10 (6.x branch) or 7.0.1-1 (7.x branch) are vulnerable. Additionally, check your ImageMagick policy file (typically at /etc/ImageMagick-6/policy.xml) to verify that vulnerable coders (MVG, MSL, HTTPS, EPHEMERAL, etc.) are disabled.
Does this affect web applications that accept image uploads?
Yes, this is the primary real-world attack scenario. Any web application that passes user-uploaded images to ImageMagick for processing — including thumbnail generation, format conversion, or resizing — is potentially vulnerable. The attacker simply uploads a crafted image file, and the malicious commands execute when ImageMagick processes it.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.