CVE-2026-106566: ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u14 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.1.43+dfsg1-1+deb13u13 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The issue affects local privileged workflows using ImageMagick before version 7.1.2-32. Exploitation requires a local attacker with high privileges and user interaction.
What can an attacker do if exploitation succeeds?
An attacker can cause a file to be overwritten with random data through delegate symlink cleanup. The reported impact is integrity-only; no confidentiality or availability impact is listed.
What configuration condition is involved?
The vulnerable cleanup path fails to check the MAGICK_SHRED_PASSES environment variable. The provided information does not state whether this condition is enabled in a default configuration.
What is the remediation?
Upgrade ImageMagick to version 7.1.2-32 or later, which fixes the issue.