PT-2026-57445 · Unknown · Imagemagick

Rexpository · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-61858

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26

Description A policy bypass exists in the APNG encoder and external delegates caused by missing validation checks. This allows attackers to bypass configured policy restrictions during the APNG encoding process to write files to disallowed paths.

Recommendations Update to version 7.1.2-26 or later.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-61858

Affected Products

Imagemagick

References · 5

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v3j6-27vc-7pw2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61858 · Security Note
• https://twitter.com/CVEnew/status/2075976700324610384 · Twitter Post
• https://twitter.com/infoflowcloud/status/2075977338815123685 · Twitter Post
• https://vulncheck.com/advisories/imagemagick-before-26-policy-bypass-via-apng-encoder · Note