Vulnerabilities

CVSS

8.4 High

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2016-05-05

Status

Published

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Weaknesses

CWE-20

Coverage 1

vulnerability

Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

Bing Image Search had two critical vulnerabilities allowing attackers to execute commands as SYSTEM on Microsoft's servers by submitting crafted SVGs. The issue stemmed from a helper component that treated SVG files as c…

The Hacker News · Jul 24, 2026 High

CVE-2026-32194CVE-2026-32191CVE-2016-3714svgcommand-injectionimagemagick

All articles mentioning it

Advisories and references

• access.redhat.com/security/vulnerabilities/2296071
• git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff...
• lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html
• securitytracker.com/id/1035742
• imagetragick.com/
• oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096....
• imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
• openwall.com/lists/oss-security/2016/05/03/13
• lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html
• lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html