Is CVE-2016-3714 being actively exploited?

Yes. CVE-2016-3714 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on September 9, 2024.

What is the CVSS score for CVE-2016-3714?

CVE-2016-3714 has a CVSS 3.1 base score of 8.4 (HIGH).

CVE-2016-3714

HIGH · CVSS 8.4CISA KEV: actively exploitedEPSS 97.5%EU EUVD: exploited

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Key facts

CVSS score: 8.4 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-20
EPSS score: 97.5% (100th percentile)
In CISA KEV: Yes, added September 9, 2024
In EU EUVD: Yes (EUVD-2016-4735)
Published: May 5, 2016
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

ImageMagick Improper Input Validation Vulnerability

Added to the KEV catalog on September 9, 2024; federal remediation due September 30, 2024.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2016-4735 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
debian / debian linux
imagemagick / imagemagick
imagemagick / imagemagick
imagemagick / imagemagick
opensuse / leap
opensuse / opensuse
suse / suse linux enterprise server

Certified products that may be affected

2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

SUSE Linux Enterprise Server 12 SP2 - NSS Cryptographic Module - SUSE, LLC - FIPS 140 3216 - historical
SUSE Linux Enterprise Server Version 12 - SUSE LLC - Common Criteria BSI-DSZ-CC-0962-2016 - archived

References

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog(Patch)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html(Third Party Advisory)
http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html(Third Party Advisory, VDB Entry)
http://rhn.redhat.com/errata/RHSA-2016-0726.html(Third Party Advisory)
http://www.debian.org/security/2016/dsa-3580(Third Party Advisory)
http://www.debian.org/security/2016/dsa-3746(Third Party Advisory)
http://www.openwall.com/lists/oss-security/2016/05/03/13(Mailing List)
http://www.openwall.com/lists/oss-security/2016/05/03/18(Mailing List)
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(Third Party Advisory)
http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate(Third Party Advisory)
http://www.securityfocus.com/archive/1/538378/100/0/threaded(Third Party Advisory, VDB Entry)
http://www.securityfocus.com/bid/89848(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1035742(Third Party Advisory, VDB Entry)
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568(Third Party Advisory)
http://www.ubuntu.com/usn/USN-2990-1(Third Party Advisory)
https://access.redhat.com/security/vulnerabilities/2296071(Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=1332492(Issue Tracking)
https://imagetragick.com/(Vendor Advisory)
https://security.gentoo.org/glsa/201611-21(Third Party Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714(US Government Resource)
https://www.exploit-db.com/exploits/39767/(Third Party Advisory, VDB Entry)
https://www.exploit-db.com/exploits/39791/(Third Party Advisory, VDB Entry)
https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588(Vendor Advisory)
https://www.imagemagick.org/script/changelog.php(Vendor Advisory)
https://www.kb.cert.org/vuls/id/250519(Third Party Advisory, US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain