---
id: "CVE-2026-116145"
kind: "vulnerability"
aliases: ["CVE-2026-116145"]
title: "ImageMagick: incomplete fix lets crafted input bypass security policy"
severity: "low"
cvss: 3.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["image-processing", "imagemagick", "package", "self-hosted"]
not_affected_if: ["no-untrusted-input", "patched-version"]
published_at: "2026-10-25T14:16:52+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:44:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116145", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# ImageMagick: incomplete fix lets crafted input bypass security policy

ImageMagick's security policy, which restricts what image operations are allowed, can be evaded because an earlier fix was incomplete. An attacker who can supply image input may perform operations the policy was meant to block.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `magick -version` (or `convert -version`) and compare the version against `6.9.13-58` and `7.1.2-32`.
- Check whether a policy file (policy.xml) restricts operations in your ImageMagick configuration.

## Fix

- Upgrade ImageMagick 6 to `6.9.13-58` or later.
- Upgrade ImageMagick 7 to `7.1.2-32` or later.

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116145

## From the sources

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j. An attacker able to supply input to ImageMagick can evade configured security policy restrictions, allowing operations the policy was intended to block.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_