CVE-2026-105081: ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName

Q: Who is exposed to this issue?

Systems using ImageMagick before 6.9.13-58 or 7.x before 7.1.2-33 are exposed if they rely on configured ImageMagick security policies to restrict access to particular paths and allow a local attacker to create symbolic links.

Q: What does an attacker need to exploit it?

The attacker needs local access with permission to create a symbolic link. They can point that link to a path restricted by ImageMagick policy, causing the policy check to be bypassed.

Q: Are default installations necessarily affected?

The issue concerns configured security-policy restrictions on paths. The provided information does not establish that an installation without relevant policy restrictions is affected.

Q: What should be done if immediate upgrading is not possible?

Limit untrusted local users' ability to create symbolic links in locations processed by ImageMagick, and avoid processing attacker-controlled paths where policy restrictions are relied upon. Upgrade to ImageMagick 6.9.13-58 or later in the 6.x series, or 7.1.2-33 or later in the 7.x series.

Published Oct 12, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-33

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick 6.x to a version that resolves this vulnerability.
Fixed in 6.9.13-58
Upgrade
Upgrade ImageMagick 7.x to a version that resolves this vulnerability.
Fixed in 7.1.2-33

Event History

Oct 12, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems using ImageMagick before 6.9.13-58 or 7.x before 7.1.2-33 are exposed if they rely on configured ImageMagick security policies to restrict access to particular paths and allow a local attacker to create symbolic links.

What does an attacker need to exploit it?

The attacker needs local access with permission to create a symbolic link. They can point that link to a path restricted by ImageMagick policy, causing the policy check to be bypassed.

Are default installations necessarily affected?

The issue concerns configured security-policy restrictions on paths. The provided information does not establish that an installation without relevant policy restrictions is affected.

What should be done if immediate upgrading is not possible?

Limit untrusted local users' ability to create symbolic links in locations processed by ImageMagick, and avoid processing attacker-controlled paths where policy restrictions are relied upon. Upgrade to ImageMagick 6.9.13-58 or later in the 6.x series, or 7.1.2-33 or later in the 7.x series.

CVE-2026-105081: ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default installations necessarily affected?

What should be done if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default installations necessarily affected?

What should be done if immediate upgrading is not possible?