UBUNTU-CVE-2026-116140: Medium severity ubuntu/imagemagick vulnerability
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must be able to cause ImageMagick to process input that triggers a delegate invocation. Exploitation also requires user interaction, and the issue is locally exploitable according to the supplied severity vector.
Are systems protected by policy.xml affected?
Yes. The vulnerability specifically allows an executable that an administrator blocked in policy.xml to still be run when a crafted input triggers a delegate invocation.
Which ImageMagick versions need remediation?
ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33 are affected. Upgrade to at least the applicable fixed version.