CVE-2026-106580 in ImageMagick
Summary
by MITRE • 10/07/2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
ImageMagick serves as a foundational toolset for digital image processing, widely deployed across web applications, content management systems, and automated pipelines to handle tasks ranging from simple format conversion to complex visual manipulation. The software operates under a security policy model designed to restrict potentially dangerous operations based on resource limits, file access permissions, and allowed methods. This architecture is critical because ImageMagick often processes untrusted input in server-side environments where malicious actors may attempt to exploit parsing logic for information disclosure or denial of service attacks.
The identified vulnerability resides within the CUT encoder component, specifically affecting versions prior to 7.1.2-31 and 6.9.13-56. The core technical flaw is a missing security-policy check during local encoding operations. In normal operation, ImageMagick evaluates incoming requests against its configured policy.xml file before executing any action. However, in this specific code path for the CUT format encoder, the validation step was omitted. This oversight allows an attacker to craft a malicious input that triggers internal memory reads which should have been blocked by security policies. The absence of these checks means that operations restricted by default configurations, such as reading from sensitive system paths or accessing memory regions outside intended bounds, can proceed without authorization.
The operational impact of this flaw is twofold, encompassing both information disclosure and service disruption. First, the ability to read data that policy should deny creates a potential vector for unauthorized access to local file systems or internal application state. Depending on the deployment context and configuration, an attacker could potentially exfiltrate sensitive files located in directories that ImageMagick is configured to protect against reading. Second, the vulnerability can cause a crash during processing. This denial of service capability arises because the unchecked operation may lead to memory corruption, segmentation faults, or other unstable states within the application process. In high-throughput environments where ImageMagick processes numerous images concurrently, such crashes can degrade system stability and availability.
This issue aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper restrictions on authorized actions for specific users or actors. Furthermore, from an offensive security perspective, the exploitation technique relates to ATT&CK T1083 File and Directory Discovery, where adversaries seek to enumerate accessible files through application vulnerabilities. The crash aspect also correlates with CWE-400 Uncontrolled Resource Consumption if the instability leads to resource exhaustion in a service context.
Mitigation for this vulnerability requires immediate version upgrades. Organizations relying on ImageMagick must update their installations to at least version 7.1.2-31 or 6.9.13-56, where the missing policy check has been implemented and validated by the development team. For environments that cannot immediately upgrade due to compatibility constraints, implementing strict input validation layers before passing data to ImageMagick can provide a partial defense-in-depth measure. Additionally, administrators should review their security-policy.xml configurations to ensure they are hardened against local file access attacks, although this does not fully mitigate the root cause within the library itself. Regular monitoring of application logs for unexpected crashes or unauthorized read attempts is also recommended to detect potential exploitation in real-time.