CVE-2026-106579: ImageMagick: Policy Bypass when using coder as the domain.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-31 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-56
Event History
Frequently Asked Questions
Which ImageMagick versions are affected and which versions contain the fix?
Versions prior to 7.1.2-31 and 6.9.13-56 are affected. The issue is fixed in ImageMagick 7.1.2-31 and 6.9.13-56.
What policy configurations are exposed?
The issue affects ImageMagick security policies that use coder as their domain. A crafted image may bypass such a policy and read data that the policy was intended to prohibit.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted image for ImageMagick to process. The supplied data does not state that authentication, privileges, or user interaction are required.
What should be done if affected policy controls are in use?
Upgrade ImageMagick to 7.1.2-31 or 6.9.13-56. The provided information does not specify an alternative mitigation for systems that cannot immediately upgrade.