CVE-2016-3714: ImageMagick Improper Input Validation Vulnerability

Overview Sources History

What happened

ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.

Affected versions

ImageMagick: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

Review the original advisory and validate affected versions.
Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference

Exploit-DB 39767ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple VulnerabilitiesNikolay Ermishkin2016-05-04Verified Exploit-DB 39791ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit)Metasploit2016-05-09Verified PoC-in-GitHub · jackdpeterson/imagick_secure_puppeta puppet module in response to CVE-2016-3714★ 0jackdpeterson2016-05-04Candidate PoC-in-GitHub · tommiionfire/CVE-2016-3714★ 0tommiionfire2016-05-04Candidate PoC-in-GitHub · chusiang/CVE-2016-3714.ansible.roleFix ImageMagick Command Injection (CVE-2016-3714) with Ansible.★ 1chusiang2016-05-05Candidate PoC-in-GitHub · jpeanut/ImageTragick-CVE-2016-3714-RShell★ 18jpeanut2016-05-05Candidate PoC-in-GitHub · Hood3dRob1n/CVE-2016-3714ImaegMagick Code Execution (CVE-2016-3714)★ 70Hood3dRob1n2016-05-07Candidate PoC-in-GitHub · JoshMorrison99/CVE-2016-3714★ 1JoshMorrison992022-12-02Candidate PoC-in-GitHub · CyberCTF/vulhub-imagemagick-cve-2016-3714Vulhub imagemagick/CVE-2016-3714: ImageTragick on a PHP upload page, run with Isoloom★ 0CyberCTF2026-10-08Candidate

Corrections Report an issue

ImageMagick Improper Input Validation Vulnerability