GHSA-jjp4-3fwf-393j: ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE

Q: Which deployments are affected?

ImageMagick versions before 7.1.2-32 and 6.9.13-57 are affected when they load a policy.xml containing an alternate valid DOCTYPE that does not end in ]>.

Published Oct 3, 2026

Updated

ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.

Affected Software

1 affected component

ImageMagick ImageMagick<7.1.2-32, <6.9.13-57

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.2-32
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 6.9.13-57

Event History

Oct 3, 2026

CVE Published

via OSV·01:11 AM

Data Sourced

via OSV·01:11 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ImageMagick versions before 7.1.2-32 and 6.9.13-57 are affected when they load a policy.xml containing an alternate valid DOCTYPE that does not end in ]>.

What does an attacker need to exploit this issue?

The attacker needs high privileges and local access, and exploitation requires a policy.xml whose alternate DOCTYPE causes LoadPolicyCache to consume the remainder of the file. The issue does not require user interaction.

What is the impact if exploitation succeeds?

Security policy rules in policy.xml are silently skipped, allowing operations that the policy was intended to restrict.

How can I determine whether a system is exposed?

Check whether the installed ImageMagick version is earlier than 7.1.2-32 or 6.9.13-57, then inspect policy.xml for a valid alternate DOCTYPE that does not end in ]>. Such a DOCTYPE can prevent policy rules from being applied.

GHSA-jjp4-3fwf-393j: ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

How can I determine whether a system is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

How can I determine whether a system is exposed?