Live › vulnerability › CVE-2026-116140
Go to dashboardImageMagick incorrectly parses delegate invocations, so an executable that policy.xml blocks can still run. An attacker who gets ImageMagick to process crafted input can run a program the administrator meant to forbid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Systems that run ImageMagick versions before 6.9.13-58 or 7.x before 7.1.2-33 and process untrusted images or files through delegates. Deployments that do not pass user-supplied input to ImageMagick can skip it, though the sources do not say how common that exposure is.
No product ranges from the sources yet.
magick -version and compare against 6.9.13-58 and 7.1.2-33policy.xml (often under /etc/ImageMagick-7/) for delegate or shell-command restrictions6.9.13-58 or later7.1.2-33 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program.
This page as .md · .json · in your agent: get_signal("CVE-2026-116140")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.