Security Policy Bypass in ImageMagick Affected by Vendor's Incomplete Fix

CVE-2026-116145

What is CVE-2026-116145?

ImageMagick, prior to version 6.9.13-58 and 7.x up to version 7.1.2-32, is affected by a security policy bypass due to an incomplete fix for a previously reported vulnerability. This flaw allows attackers who can input data into ImageMagick to circumvent established security policies, potentially executing operations that the policy is designed to restrict. It is critical for users to update their installations to mitigate the risks associated with this vulnerability.

References