CVE-2016-3715: ImageMagick EPHEMERAL coder allows arbitrary file deletion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a very high EPSS score and public exploit code, though the CVSS impact is limited to file deletion.

What it is

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 lets a crafted image cause deletion of arbitrary files. This is part of the ImageTragick family of coder flaws and matters because image processing is often exposed to untrusted input, allowing destructive file operations on the host.

Impact

An attacker can delete files the ImageMagick process can write to, causing data loss or denial of service. There is no confidentiality or integrity gain beyond the deletion itself per the CVSS vector.

Attack surface

Reached by supplying a crafted image to an application that uses ImageMagick for conversion or thumbnailing. The CVSS vector requires user interaction (UI:R) and no privileges (PR:N), and is scored local (AV:L), so the image must be opened or processed on the target.

Exploitation

CISA KEV lists it as exploited in the wild since 2021-11-03, and EPSS is very high at 0.754 (99.5th percentile). Public exploit references exist (Exploit-DB 39767 and a vendor forum post).

What to do

• Upgrade ImageMagick to 6.9.3-10 or 7.0.1-1 or later, or apply the vendor patch referenced in the ImageMagick ChangeLog.
• Apply distribution updates from Red Hat, Ubuntu, Debian, SUSE, Oracle or Gentoo advisories for the affected packages.
• Disable or restrict the EPHEMERAL coder and other risky coders via policy.xml where the full coder set is not needed.
• Run ImageMagick processing in a sandbox or container with a read-only filesystem and minimal write permissions.
• Validate and re-encode untrusted images before passing them to ImageMagick.

Detection

• Monitor for ImageMagick processes deleting files outside expected output directories.
• Alert on image files containing EPHEMERAL coder directives or other coder references in content.
• Audit application logs for image processing errors or unexpected file removals correlated with uploads.
• Track ImageMagick versions in use and flag hosts still running pre-6.9.3-10 or pre-7.0.1-1 builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.