Policy Bypass Vulnerability in ImageMagick by ImageMagick

CVE-2026-116140

What is CVE-2026-116140?

ImageMagick versions prior to 6.9.13-58 and 7.x before 7.1.2-33 contain a vulnerability that arises from incorrect parsing of delegate invocations. This flaw allows an attacker to execute blocked executable files specified in the policy.xml configuration, circumventing the security measures put in place by administrators. By crafting malicious input that triggers this vulnerability, attackers can leverage ImageMagick's processing capabilities to run unauthorized programs, leading to potential exploitation and compromise of the system.

References