CVE-2026-116145

What it actually does

The flaw permits evasion of ImageMagick security policies through specially crafted input that bypasses an incomplete prior restriction, allowing operations the policy was intended to block.

Why it matters to the business

Organizations relying on ImageMagick for image handling face weakened security controls, raising the chance of unauthorized processing that could lead to data exposure or chained attacks.

How an attack unfolds

An attacker supplies crafted input to an application using the vulnerable ImageMagick library; the incomplete policy check fails to enforce restrictions, enabling blocked operations such as dangerous image conversions or file accesses.

How to fix it

Upgrade ImageMagick to 6.9.13-58 or 7.1.2-32 or later and reapply security policies; verify that the updated versions correctly enforce all intended restrictions.

How to confirm the fix worked

Confirm installed versions meet or exceed 6.9.13-58 / 7.1.2-32, then test policy enforcement using sample inputs that previously bypassed restrictions.

Typical attack path

1. Locate an application or service that invokes ImageMagick on untrusted input
2. Craft an image or file that triggers the policy bypass
3. Deliver the input to perform restricted operations
4. Leverage the resulting capability for further actions

How to detect it

Review application and system logs for image processing events that should have been blocked by policy, unusual file system accesses during conversions, or repeated failed policy checks followed by success.

What your security team should do

• Apply the fixed ImageMagick versions immediately due to the recent publication
• Audit all applications using ImageMagick for policy coverage
• Implement input sanitization layers in front of image processing