Cloudanix VulnDB

CVE-2026-116140

Low · 3.3

CVSS

3.3

EPSS

0.1%

Published

Oct 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Image processing software can be tricked into running programs that administrators tried to block, which could let attackers gain extra access on affected systems.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Privilege Gain
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

ImageMagick's delegate invocation parser fails to enforce restrictions defined in policy.xml, allowing execution of administrator-blocked programs when processing inputs that trigger delegate calls.

Why it matters to the business

Systems relying on ImageMagick for image handling face risk of unauthorized program execution bypassing security policies; the issue was disclosed only one day ago with no known exploitation or ransomware use yet, but organizations should prioritize updates to limit potential system compromise or lateral movement.

How an attack unfolds

An attacker supplies crafted input to ImageMagick that triggers a delegate invocation for an external executable blocked in policy.xml; due to incorrect parsing, the block is bypassed and the program executes with the privileges of the ImageMagick process.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or later for the 6.x branch and 7.1.2-33 or later for the 7.x branch; review and tighten policy.xml rules as a defense-in-depth measure.

How to confirm the fix worked

Verify installed ImageMagick version meets or exceeds the fixed releases; test policy enforcement by attempting to process inputs that should trigger blocked delegates and confirm they are now denied.

Typical attack path

  1. Identify or craft input that causes ImageMagick to invoke a delegate
  2. Submit the input via any application or command line using ImageMagick
  3. Policy bypass allows execution of the otherwise restricted program

How to detect it

Review system and application logs for ImageMagick processes spawning child processes that match entries previously blocked in policy.xml; inspect command-line arguments or delegate invocations around the time of image processing.

What your security team should do

  • Apply the fixed ImageMagick versions as soon as possible given the recent disclosure
  • Audit all ImageMagick deployments and dependent applications for exposure
  • Monitor process creation logs for unexpected executables launched by ImageMagick
  • Consider disabling unused delegates entirely in policy.xml

The record

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities