CVE-2026-106566: ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

Q: Who is realistically exposed to this issue?

The issue affects local privileged workflows using ImageMagick before version 7.1.2-32. Exploitation requires a local attacker with high privileges and user interaction.

Q: What can an attacker do if exploitation succeeds?

An attacker can cause a file to be overwritten with random data through delegate symlink cleanup. The reported impact is integrity-only; no confidentiality or availability impact is listed.

Q: What configuration condition is involved?

The vulnerable cleanup path fails to check the MAGICK_SHRED_PASSES environment variable. The provided information does not state whether this condition is enabled in a default configuration.

Q: What is the remediation?

Upgrade ImageMagick to version 7.1.2-32 or later, which fixes the issue.

Published Oct 7, 2026

Updated

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-32

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-32

Event History

Oct 7, 2026

CVE Published

via MITRE·03:21 PM

Data Sourced

via MITRE·03:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

The issue affects local privileged workflows using ImageMagick before version 7.1.2-32. Exploitation requires a local attacker with high privileges and user interaction.

What can an attacker do if exploitation succeeds?

An attacker can cause a file to be overwritten with random data through delegate symlink cleanup. The reported impact is integrity-only; no confidentiality or availability impact is listed.

What configuration condition is involved?

The vulnerable cleanup path fails to check the MAGICK_SHRED_PASSES environment variable. The provided information does not state whether this condition is enabled in a default configuration.

What is the remediation?

Upgrade ImageMagick to version 7.1.2-32 or later, which fixes the issue.

CVE-2026-106566: ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What can an attacker do if exploitation succeeds?

What configuration condition is involved?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What can an attacker do if exploitation succeeds?

What configuration condition is involved?

What is the remediation?