CVE-2026-25966: ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access
ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.
Other sources
The shipped “secure” security policy includes a rule intended to prevent reading/writing from standard streams:
xml <policy domain="path" rights="none" pattern="-"/>
However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). This path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of “no stdin/stdout”.
To resolve this, users can add the following change to their security policy.
xml <policy domain="path" rights="none" pattern="fd:"/>
And this will also be included in ImageMagick's more secure policies by default.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Magick.NET-Q8-x86to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q8-arm64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q8-OpenMP-x64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q8-OpenMP-arm64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q8-AnyCPUto a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-QMagick.NET-Q16-x8616-x64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-x64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-arm64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-OpenMP-x86to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-OpenMP-x64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-OpenMP-arm64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-x86to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-x64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-arm64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-OpenMP-arm64to a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-HDRI-AnyCPUto a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
nuget/Magick.NET-Q16-AnyCPUto a version that resolves this vulnerability.Fixed in 14.10.3 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-15 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-40 - Configuration
Add the following <policy> entries to the ImageMagick security policy (e.g., policy.xml or policy-secure.xml) to block '-' and 'fd:*' path forms and prevent stdin/stdout access: <policy domain="path" rights="none" pattern="-"/> and <policy domain="path" rights="none" pattern="fd:*"/>.
ImageMagick security policy (policy.xml / policy-secure.xml) policy entries (domain="path") = <policy domain=\"path\" rights=\"none\" pattern=\"-\"/>; <policy domain=\"path\" rights=\"none\" pattern=\"fd:*\"/>
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25966?
The severity of CVE-2026-25966 is classified as high due to its ability to bypass security policies and access sensitive data.
How do I fix CVE-2026-25966?
To fix CVE-2026-25966, update ImageMagick to version 14.10.3 or later.
What impact does CVE-2026-25966 have on ImageMagick users?
CVE-2026-25966 allows remote attackers to bypass security restrictions, potentially leading to unauthorized read/write access via stdin/stdout.
Is CVE-2026-25966 present in all ImageMagick versions?
CVE-2026-25966 affects ImageMagick versions up to 6.9.13-40 and 7.1.2-15; always check release notes for specific versions.
What should I do if I cannot update ImageMagick immediately due to compatibility issues?
If an immediate update is not possible for CVE-2026-25966, consider applying temporary security measures or isolating affected services until the update can be completed.