CVE-2026-105083: ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE
ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-57
Event History
Frequently Asked Questions
Which ImageMagick releases include the fix?
Upgrade to ImageMagick 7.1.2-32 or later, or 6.9.13-57 or later. Earlier releases are affected.
What policy.xml condition triggers the bypass?
The condition requires a valid alternate DOCTYPE whose declaration does not end in ']>'. Under that condition, LoadPolicyCache consumes the remainder of the file and skips all subsequent security policy rules.
How can I check whether an existing policy file is being bypassed?
Inspect policy.xml for a DOCTYPE declaration that does not end in ']>' and determine whether policy rules follow it. In an affected release, rules after that declaration are not applied, allowing operations that the policy was intended to restrict.