AppYour homeOperatorJournalAlerts
Request an introduction
Being used in attacks, by company

ImageMagick flaws being used in attacks

CISA lists 3 flaws in ImageMagick products as being used in attacks, most recently on 9 Sep 2024.

ImageMagickBeing used in attacks
On CISA’s list
3 flaws, added between 3 Nov 2021 and 9 Sep 2024
Most recent
CVE-2016-3714, ImageMagick Improper Input Validation Vulnerability, added 9 Sep 2024
Used in ransomware
None known to CISA
Products
ImageMagick (3)
What’s known.From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026.

What to do

  1. Update every ImageMagick product you use.Install the updates ImageMagick offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
  2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
  3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Search ImageMagick in the lookupLook up something else

Every flaw, newest first

  1. Being used in attacks
    ImageMagick
    CVE-2016-3714ImageMagick Improper Input Validation Vulnerability
    ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
  2. Being used in attacks
    ImageMagick
    CVE-2016-3718ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
    ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  3. Being used in attacks
    ImageMagick
    CVE-2016-3715ImageMagick Arbitrary File Deletion Vulnerability
    ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. ImageMagick on CISA’s site.

Every companyLookup · HARD’s advisories · Alerts