CISA KEV · Known exploitedMedium

CVE-2016-3715

ImageMagick

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

PRIORITY ASSESSMENT

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability75.4%

Technical severityCVSS 5.5

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Product: ImageMagick
Affected versions: 6.0, 7.0, 6.7, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 6.0 s390x, 7.0 s390x, 6.7 s390x, 7.2 s390x, 7.3 s390x, 7.4 s390x, 7.5 s390x, 7.6 s390x, 7.7 s390x, 6.0 ppc64
Fixed versions: 6.9.3-10

Confirm exposure before applying a vendor-supported change.

CISA required action

Apply updates per vendor instructions.

Due date: 2022.05.03

1
Identify
Confirm that ImageMagick and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.