CVE-2026-105823: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-105823 is a security policy bypass vulnerability in ImageMagick's CUT encoder that allows unauthenticated local attackers to circumvent configured security policies, potentially crashing the application or leaking sensitive data. It affects ImageMagick versions before 6.9.13-56 (6.x branch) and before 7.1.2-31 (7.x branch). The CVE was initially published on October 8, 2026, and has since been marked as Rejected (duplicate) by the CVE authority, with the canonical advisory tracked under GHSA-r868-pmwh-fv2c (CVE-2026-106580). It carries a CVSS v3.1 base score of 4.0 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, ImageMagick Advisory, Red Hat Bugzilla).

The root cause is a missing security policy check in ImageMagick's CUT encoder (CWE-284: Improper Access Control; CWE-749: Exposed Dangerous Method or Function). ImageMagick supports administrator-defined security policies (via policy.xml) to restrict certain operations or file formats; the CUT encoder fails to consult these policies before processing input, allowing them to be bypassed entirely. An attacker with local access can supply a crafted CUT-format image file to trigger either an application crash (availability impact) or a leak of sensitive data from memory (confidentiality impact). Exploitation requires high attack complexity and specific deployment conditions (attack requirements: present), limiting practical exploitability (ImageMagick Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated local attacker to bypass ImageMagick's configured security policies via the CUT encoder, resulting in either a denial-of-service (application crash) or limited disclosure of sensitive data processed by ImageMagick. The integrity of the system is not directly affected, and the scope is limited to the vulnerable ImageMagick process itself with no impact on subsequent systems. The risk is most relevant in environments where ImageMagick processes untrusted user-supplied files and relies on security policies for access control enforcement (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.113% (1st percentile), indicating a very low probability of exploitation in the near term. The CVE has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. The vulnerability is also marked as a rejected duplicate, with the canonical issue tracked under CVE-2026-106580 (GitHub Advisory, ImageMagick Advisory).

Update ImageMagick to version 6.9.13-56 or later (6.x branch) or 7.1.2-31 or later (7.x branch) to remediate the vulnerability. As a temporary workaround prior to patching, restrict local access to ImageMagick processes and limit the ability to process untrusted CUT-formatted input files. Additionally, reviewing and hardening the ImageMagick policy.xml configuration to explicitly deny the CUT format can reduce exposure until the patch is applied (ImageMagick Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher santhreal and published by ImageMagick maintainer dlemstra via the GitHub Security Advisory GHSA-r868-pmwh-fv2c on September 21, 2026. Red Hat tracked the issue via Bugzilla (Bug 2547976) with medium priority/severity. No significant broader media coverage or notable community commentary has been observed, consistent with the low CVSS score and absence of public exploitation (ImageMagick Advisory, Red Hat Bugzilla).