CVE-2026-106579GHSA-vcjj-32hg-qpx5
ImageMagick: Policy Bypass when using coder as the domain.
ImageMagick ImageMagickLibraries & packages
CVSS
6.2MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
Text from CVE List
Affected versions 2
- ImageMagickaffected: < 6.9.13-56CVE List
- ImageMagickaffected: >= 7.0.0, < 7.1.2-31CVE List
References 7
- github.com/ImageMagick/ImageMagick/commit/82f373fedb3425c83a239103ab86f4fa86fd49acFixvia CVE List
- github.com/ImageMagick/ImageMagick/commit/dcdbbf4278fab20a32a4ad80e64cb95c368ca8ddFixvia CVE List
- github.com/ImageMagick/ImageMagick6/commit/ac85c8e0a319b1eaf4c3d05d326605f5bae723d6Fixvia CVE List
- github.com/ImageMagick/ImageMagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222Fixvia CVE List
- github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31Fixvia CVE List
- github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56Fixvia CVE List
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vcjj-32hg-qpx5Advisoryvia CVE List