CVE-2026-106579
ImageMagick is free and open-source software used for editing and manipulating digital images
- Risk score
- 55/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-3…
- Affected
- Imagemagick before 7.1.2
- Fix
- Upgrade Imagemagick to 7.1.2 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Imagemagick: Yellow, plan it in. ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7…
The flaws
- CVE-2026-106579: ImageMagick is free and open-source software used for editing and manipulating digital images (CVSS 7.5 · EPSS 0%)
- CVE-2026-106580: Access control flaw can lead to denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-106573: Denial of service (CVSS 7.5 · EPSS 0%)
- CVE-2026-106576: Denial of service (CVSS 7.5 · EPSS 0%)
The fix
Upgrade Imagemagick: 7.1.2 or later on your release line
Who is exposed: Imagemagick before 7.1.2
Where it stands
- No known exploitation
Connects to
- Same product: Earlier Imagemagick warnings. 18 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
- https://github.com/ImageMagick/ImageMagick/commit/82f373fedb3425c83a239103ab86f4fa86fd49ac
- https://github.com/ImageMagick/ImageMagick/commit/dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd
- https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vcjj-32hg-qpx5
- https://github.com/ImageMagick/ImageMagick6/commit/ac85c8e0a319b1eaf4c3d05d326605f5bae723d6
- https://github.com/ImageMagick/ImageMagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222
- https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56
Original description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
Last activity 7 Oct 2026. Patch Forecast updates every hour.