CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability
CVSS: 5.8v2.0MediumKEVAnalyzed
AliasesUBUNTU-CVE-2016-3715DEBIAN-CVE-2016-3715
Published 05-05-2016Last modified 21-10-2025
Vulnerability summary
CVE-2016-3715 is a medium (CVSS 5.8) vulnerability in ImageMagick. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 75.31% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
5.8/10
010
Medium · v2.0 (NVD)EPSS score
75.31%
0%100%
Critical · 0.00 pp in 30 daysKEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2reference, exploit-database
Advisory lineage
Upstream 0 · Downstream 12 · Related 6Timeline
- 05-05-2016PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVImageMagick Arbitrary File Deletion Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVSS metrics
6 scores · 4 sources · 3 versionsMedium 5.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSourcesAll 4 agree
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Medium 5.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSourcesSingle source
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
75.31%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 75.31% on 18-09-2026
18-09-202618-10-2026
EPSS score75.31%
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2016-3715
Public exploits
2 foundExploit Reference (imagemagick.org)
Maturity: unknown
ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat16 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_eus6.7 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_for_ibm_z_systems6.0_s390x | 7.0_s390x
- enterprise_linux_for_ibm_z_systems_eus6.7_s390x | 7.2_s390x | 7.3_s390x | 7.4_s390x | 7.5_s390x | 7.6_s390x | 7.7_s390x
- enterprise_linux_for_power_big_endian6.0_ppc64 | 7.0_ppc64
Suse8 products
- linux_enterprise_debuginfo11:sp2 | 11:sp3 | 11:sp4
- linux_enterprise_desktop12 | 12:sp1
- linux_enterprise_server11:sp2 | 11:sp3 | 11:sp4 | 12 | 12:sp1
- linux_enterprise_software_development_kit11:sp4 | 12 | 12:sp1
- linux_enterprise_workstation_extension12 | 12:sp1
Debian2 products
- graphicsmagick< 1.3.24-1
- imagemagick< 8:6.9.6.2+dfsg-2
Ubuntu2 products
- graphicsmagick< 1.3.18-1ubuntu3.1 | < 1.3.23-1ubuntu0.1
- imagemagick< 8:6.7.7.10-6ubuntu3.1 | < 8:6.8.9.9-7ubuntu5.1
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.10 | 16.04
Imagemagick1 product
- imagemagick< 6.9.3-10 | 7.0.0-0 | 7.0.1-0
8 vendors · 34 products
References
26 links- git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLogX Refsource CONFIRMBroken LinkPatch
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlX Refsource CONFIRMThird Party Advisory
- www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588X Refsource CONFIRMExploitVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.securityfocus.com/archive/1/538378/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
Show all 26 references
- www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlX Refsource CONFIRMThird Party Advisory
- www.openwall.com/lists/oss-security/2016/05/03/18Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
www.debian.org/security/2016/dsa-3746Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568Vendor AdvisoryX Refsource SLACKWAREMailing ListThird Party Advisory
- www.debian.org/security/2016/dsa-3580Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3715Government ResourceUS Government Resource