CVE-2026-116140: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing

Q: Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.1.2-33 are affected when they rely on policy.xml to block executables that can be invoked through delegates.

Q: What must an attacker be able to do to exploit it?

An attacker must be able to cause ImageMagick to process input that triggers a delegate invocation. The issue is locally scored and requires user interaction, but no privileges are required according to the provided vector.

Q: Are default installations necessarily affected?

The issue specifically bypasses administrator-defined policy.xml restrictions on blocked executables. The provided information does not establish whether a default policy configuration blocks any relevant executable.

Q: What should be done if immediate patching is not possible?

The provided information does not identify a complete workaround. Reduce exposure by preventing untrusted input from reaching ImageMagick operations that can trigger delegate invocations until affected versions can be updated.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.1.2-33 are affected when they rely on policy.xml to block executables that can be invoked through delegates.

What must an attacker be able to do to exploit it?

An attacker must be able to cause ImageMagick to process input that triggers a delegate invocation. The issue is locally scored and requires user interaction, but no privileges are required according to the provided vector.

Are default installations necessarily affected?

The issue specifically bypasses administrator-defined policy.xml restrictions on blocked executables. The provided information does not establish whether a default policy configuration blocks any relevant executable.

What should be done if immediate patching is not possible?

The provided information does not identify a complete workaround. Reduce exposure by preventing untrusted input from reaching ImageMagick operations that can trigger delegate invocations until affected versions can be updated.

CVE-2026-116140: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

Are default installations necessarily affected?

What should be done if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

Are default installations necessarily affected?

What should be done if immediate patching is not possible?