ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106580US | high8.2 | — | ||
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder a… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105823.jsonADVISORY
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2cADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-105823ADVISORY
- https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-cut-encoderADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan