CVE-2026-106579
MEDIUM
6,2
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
AI Translation Available
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
551
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
IncompleteCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based, Web Server
https://github.com/ImageMagick/ImageMagick6/commit/ac85c8e0a319b1eaf4c3d05d3266…
https://github.com/ImageMagick/ImageMagick6/commit/c54667bfe605ebdc17c23cb70a26…
https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56
https://github.com/ImageMagick/ImageMagick/commit/82f373fedb3425c83a239103ab86f…
https://github.com/ImageMagick/ImageMagick/commit/dcdbbf4278fab20a32a4ad80e64cb…
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vcjj-32hg-q…