CVE-2026-105403: ImageMagick before 7.1.2-31 Security Policy Bypass via Coder Domain

Q: Which deployments are exposed to this issue?

Deployments using ImageMagick before 6.9.13-56 or 7.x before 7.1.2-31 are exposed if their security policy relies on the coder domain to block image formats. The issue concerns policy enforcement rather than all ImageMagick processing.

Q: What does an attacker need to exploit the bypass?

An attacker needs to be able to supply a crafted image that ImageMagick will process. No privileges or user interaction are required according to the provided CVSS vector, but exploitation is local.

Q: Are default configurations affected?

The provided information identifies configurations that use coder-domain policy restrictions as affected. It does not state whether ImageMagick's default security policy uses those restrictions.

Q: What mitigation is available if an immediate upgrade is not possible?

Use the module domain rather than the coder domain for policy restrictions, since the bypass specifically affects policies using coder. Ensure untrusted images are not processed in formats administrators intend to block until the upgrade can be applied.

Published Oct 8, 2026

Updated

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 allows a security policy bypass when a policy uses coder, rather than module, as its domain. An attacker can supply a crafted image to evade coder-based policy restrictions, causing ImageMagick to process formats the administrator intended to block.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-56, >=7.0.0<7.1.2-31

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-56
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-31

Event History

Oct 8, 2026

CVE Published

via MITRE·02:10 PM

Data Sourced

via MITRE·02:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick before 6.9.13-56 or 7.x before 7.1.2-31 are exposed if their security policy relies on the coder domain to block image formats. The issue concerns policy enforcement rather than all ImageMagick processing.

What does an attacker need to exploit the bypass?

An attacker needs to be able to supply a crafted image that ImageMagick will process. No privileges or user interaction are required according to the provided CVSS vector, but exploitation is local.

Are default configurations affected?

The provided information identifies configurations that use coder-domain policy restrictions as affected. It does not state whether ImageMagick's default security policy uses those restrictions.

What mitigation is available if an immediate upgrade is not possible?

Use the module domain rather than the coder domain for policy restrictions, since the bypass specifically affects policies using coder. Ensure untrusted images are not processed in formats administrators intend to block until the upgrade can be applied.

CVE-2026-105403: ImageMagick before 7.1.2-31 Security Policy Bypass via Coder Domain

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

Are default configurations affected?

What mitigation is available if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

Are default configurations affected?

What mitigation is available if an immediate upgrade is not possible?