CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability

Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.3% chance of exploitation in the next 30 days.

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Affected products

  • Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only; version 16.04 only
  • ImageMagick ImageMagick: before 6.9.3-10 (fixed in 6.9.3-10); version 7.0.0-0 only; version 7.0.1-0 only
  • Opensuse Leap: version 42.1 only
  • Opensuse Opensuse: version 13.2 only
  • Oracle Linux: version 6 only; version 7 only
  • Oracle Solaris: version 10 only; version 11.3 only
  • Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
  • Red Hat Enterprise Linux Eus: version 6.7 only; version 7.2 only; version 7.3 only; version 7.4 only; version 7.5 only; version 7.6 only; …
  • Red Hat Enterprise Linux For IBM Z Systems: version 6.0_s390x only; version 7.0_s390x only
  • Red Hat Enterprise Linux For IBM Z Systems Eus: version 6.7_s390x only; version 7.2_s390x only; version 7.3_s390x only; version 7.4_s390x only; version 7.5_s390x only; version 7.6_s390x only; …
  • Red Hat Enterprise Linux For Power Big Endian: version 6.0_ppc64 only; version 7.0_ppc64 only
  • Red Hat Enterprise Linux For Power Big Endian Eus: version 6.7_ppc64 only; version 7.2_ppc64 only; version 7.3_ppc64 only; version 7.4_ppc64 only; version 7.5_ppc64 only; version 7.6_ppc64 only; …
  • Red Hat Enterprise Linux For Power Little Endian: version 7.0_ppc64le only
  • Red Hat Enterprise Linux For Power Little Endian Eus: version 7.2_ppc64le only; version 7.3_ppc64le only; version 7.4_ppc64le only; version 7.5_ppc64le only; version 7.6_ppc64le only; version 7.7_ppc64le only
  • Red Hat Enterprise Linux Hpc Node: version 6.0 only; version 7.0 only
  • Red Hat Enterprise Linux Hpc Node Eus: version 7.2 only
  • Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
  • Red Hat Enterprise Linux Server Aus: version 7.2 only; version 7.3 only; version 7.4 only; version 7.6 only; version 7.7 only
  • Red Hat Enterprise Linux Server From Rhui: version 6.0 only; version 7.0 only
  • Red Hat Enterprise Linux Server Supplementary Eus: version 6.7z only
  • Red Hat Enterprise Linux Server Tus: version 7.2 only; version 7.3 only; version 7.6 only; version 7.7 only
  • Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only
  • Suse Linux Enterprise Debuginfo: version 11 only
  • Suse Linux Enterprise Desktop: version 12 only
  • Suse Linux Enterprise Server: version 11 only; version 12 only
  • and 5 more

Published 2016-05-05. Last modified 2026-06-17.