Policy Bypass Vulnerability in ImageMagick for PS, PDF, and XPS Decoders

CVE-2026-116143

What is CVE-2026-116143?

ImageMagick versions prior to 6.9.13-58 and the 7.x series before 7.1.2-33 are susceptible to a policy bypass vulnerability in their PS, PDF, and XPS decoders. This flaw allows attackers to circumvent the security policy's limits on scene selection. By supplying specific arguments, an attacker can process an excessive number of scenes, potentially leading to resource exhaustion and degraded performance. It is crucial for users to update to the latest versions to mitigate this risk.

References