Live › vulnerability › CVE-2026-116145
Go to dashboardImageMagick's security policy, which restricts what image operations are allowed, can be evaded because an earlier fix was incomplete. An attacker who can supply image input may perform operations the policy was meant to block.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Systems that run ImageMagick below the fixed versions and rely on its policy.xml restrictions to limit what untrusted uploads can do. Servers that never process untrusted images, or that run a fixed version, can skip it.
No product ranges from the sources yet.
magick -version (or convert -version) and compare the version against 6.9.13-58 and 7.1.2-32.6.9.13-58 or later.7.1.2-32 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j. An attacker able to supply input to ImageMagick can evade configured security policy restrictions, allowing operations the policy was intended to block.
This page as .md · .json · in your agent: get_signal("CVE-2026-116145")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.