PT-2026-21626 · Unknown · Imagemagick
Lemstrap
·
Published
2026-02-24
·
Updated
2026-03-30
·
CVE-2026-25966
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions prior to 7.1.2-15
ImageMagick versions prior to 6.9.13-40
Description
ImageMagick is software used for editing and manipulating digital images. The software’s security policy, intended to prevent reading/writing from standard streams, was bypassed due to the use of fd: pseudo-filenames. Specifically, the secure policy templates did not block this path form, allowing a bypass of the protection goal of preventing standard input/output access.
Recommendations
Update to ImageMagick version 7.1.2-15 or later.
Update to ImageMagick version 6.9.13-40 or later.
As a workaround, manually add the necessary change to your security policy.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Imagemagick