DEBIAN-CVE-2026-116140: Low severity debian/imagemagick vulnerability

Q: Which deployments are exposed?

Deployments using ImageMagick before 6.9.13-58 or 7.x before 7.1.2-33 are affected when they process input that can trigger a delegate invocation. The bypass is relevant where an administrator has used policy.xml to block an executable.

Q: What does an attacker need to exploit this issue?

An attacker needs to cause ImageMagick to process input that triggers a delegate invocation. No privileges are required, but user interaction is required according to the supplied severity vector.

Q: How can I determine whether my installation is affected?

Check the installed ImageMagick version: versions earlier than 6.9.13-58, and 7.x versions earlier than 7.1.2-33, are affected. Also review whether policy.xml blocks executables that may be invoked through delegates.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using ImageMagick before 6.9.13-58 or 7.x before 7.1.2-33 are affected when they process input that can trigger a delegate invocation. The bypass is relevant where an administrator has used policy.xml to block an executable.

What does an attacker need to exploit this issue?

An attacker needs to cause ImageMagick to process input that triggers a delegate invocation. No privileges are required, but user interaction is required according to the supplied severity vector.

How can I determine whether my installation is affected?

Check the installed ImageMagick version: versions earlier than 6.9.13-58, and 7.x versions earlier than 7.1.2-33, are affected. Also review whether policy.xml blocks executables that may be invoked through delegates.

DEBIAN-CVE-2026-116140: Low severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my installation is affected?