CVE-2026-116145: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix

Q: Which ImageMagick releases need to be remediated?

ImageMagick releases before 6.9.13-58 in the 6.x line and before 7.1.2-32 in the 7.x line are affected.

Q: What access does an attacker need to exploit this issue?

The attacker must be able to supply input to ImageMagick. The supplied input can be used to evade configured security-policy restrictions and perform operations those restrictions were intended to block.

Q: Does exploitation require prior access or user interaction?

The provided vector indicates local attack access, high attack complexity, and high privileges required. It does not require user interaction.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j. An attacker able to supply input to ImageMagick can evade configured security policy restrictions, allowing operations the policy was intended to block.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-32

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-58
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-32

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which ImageMagick releases need to be remediated?

ImageMagick releases before 6.9.13-58 in the 6.x line and before 7.1.2-32 in the 7.x line are affected.

What access does an attacker need to exploit this issue?

The attacker must be able to supply input to ImageMagick. The supplied input can be used to evade configured security-policy restrictions and perform operations those restrictions were intended to block.

Does exploitation require prior access or user interaction?

The provided vector indicates local attack access, high attack complexity, and high privileges required. It does not require user interaction.

CVE-2026-116145: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix

Affected Software

Remediation

Event History

Frequently Asked Questions

Which ImageMagick releases need to be remediated?

What access does an attacker need to exploit this issue?

Does exploitation require prior access or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Which ImageMagick releases need to be remediated?

What access does an attacker need to exploit this issue?

Does exploitation require prior access or user interaction?