CVE-2026-105826: ImageMagick before 7.1.2-30 Security Policy Bypass via MAT Decoder
ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a security policy bypass in the MAT decoder, which does not enforce configured temporary file size limits when reading highly compressed data. Attackers can supply a crafted MAT image whose decompressed data is written to temporary files larger than the policy allows, consuming disk resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-55 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-30
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions before 6.9.13-55 or 7.x before 7.1.2-30 are affected. Exposure is relevant where an attacker can cause ImageMagick to read a supplied MAT image.
What does an attacker need to exploit the issue?
An attacker needs to provide a crafted, highly compressed MAT image for ImageMagick to decode. No privileges or user interaction are required according to the supplied severity vector.
Are configured temporary file size limits sufficient protection?
No. The MAT decoder does not enforce configured temporary file size limits when processing highly compressed data, allowing decompressed data to exceed the policy limit in temporary files.
What is the practical impact of successful exploitation?
The crafted image can cause ImageMagick to write oversized decompressed data to temporary files and consume disk resources. The provided impact information indicates an availability impact, with no stated confidentiality or integrity impact.