CVE-2016-3718

KEVImageMagick Server-Side Request Forgery (SSRF) Vulnerability

Description

ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

PublishedMay 5, 2016

Last modifiedJun 17, 2026

Added to KEVNov 3, 2021

Remediation dueMay 3, 2022

References

git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLogPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-0726.htmlThird Party Advisory
debian.org/security/2016/dsa-3580Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2016/05/03/18Mailing ListThird Party Advisory
oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
securityfocus.com/archive/1/538378/100/0/threadedBroken LinkThird Party Advisory

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1638 days
CVSS: 5.5 MEDIUM
EPSS (30-day exploit probability): 75.6% · top 1% of all CVEs
Weakness: CWE-918

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.