CVE-2026-105823: ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagick 6.xto a version that resolves this vulnerability.Fixed in 6.9.13-56 - Upgrade
Upgrade
ImageMagick 7.xto a version that resolves this vulnerability.Fixed in 7.1.2-31
Event History
Frequently Asked Questions
Which deployments are affected?
ImageMagick versions before 6.9.13-56 and 7.x versions before 7.1.2-31 are affected when they process input through the CUT encoder. The issue concerns configured security policies because the CUT encoder does not perform the required policy check.
What does an attacker need to exploit this issue?
An attacker needs to supply crafted input that is processed by the CUT encoder. No privileges or user interaction are indicated by the provided vector, but exploitation has high attack complexity and requires local access.
What can happen if exploitation succeeds?
A successful policy bypass can allow an attacker to crash the application or leak sensitive data. The provided severity vector indicates limited confidentiality and availability impact, with no integrity impact.
What should be done if an affected version cannot be upgraded immediately?
The provided information does not specify a workaround. As an interim exposure-reduction measure supported by the advisory details, avoid processing untrusted crafted input through the CUT encoder until an updated ImageMagick version can be deployed.