CVE-2026-55628

What it actually does

This is an authorization bypass in the image-processing command path for the `-concatenate` operation. In versions before 7.1.2-26he, that operation does not consistently enforce configured security policy restrictions, which can allow a crafted invocation or attacker-influenced processing workflow to read from or write to file paths that should have been blocked by policy. The CVSS vector indicates local attack conditions with low complexity, no privileges required, and required user interaction, with the primary modeled impact being high availability impact rather than direct confidentiality or integrity compromise.

Why it matters to the business

If an organization relies on the product’s security policy to restrict which files image-processing jobs may access, this flaw can let untrusted or semi-trusted image processing bypass those guardrails. The most likely operational consequence is disruption, such as overwriting or exhausting restricted locations, causing failed processing jobs, service instability, or denial of service in applications that invoke image conversion on user-supplied content. The issue is not in CISA KEV, is not known to be used in ransomware campaigns, and currently has very low EPSS, so urgency is moderate unless the software processes untrusted files or command options.

How an attack unfolds

An attacker first needs a path to influence a local image-processing invocation, such as convincing a user or an application workflow to process attacker-controlled input that triggers or includes the `-concatenate` operation. On a vulnerable version, the operation fails to apply the expected security policy checks. As a result, processing can interact with paths that the policy was intended to deny. Depending on how the surrounding application invokes the tool and what filesystem permissions the process has, the attacker may cause reads from or writes to disallowed paths or create conditions that consume resources, corrupt outputs, or interrupt service. Successful exploitation is constrained by local execution context, filesystem permissions, and the need for user interaction or an application workflow that processes attacker-controlled content.

How to fix it

Upgrade to the fixed release, version 7.1.2-26 or later; where package naming distinguishes the hardened build, use 7.1.2-26he or later. Prioritize systems and application containers that process untrusted images, documents, uploads, or user-controlled conversion parameters. If immediate upgrade is not possible, restrict access to the vulnerable binary, prevent users or applications from passing arbitrary command-line options, isolate processing in a sandbox or container with a minimal filesystem view, run processing under a low-privilege account, enforce OS-level filesystem permissions independent of the product policy, and consider temporarily blocking workflows that require `-concatenate` for untrusted input.

How to confirm the fix worked

Confirm installed versions report 7.1.2-26 / 7.1.2-26he or later using the product’s version command or package manager. Review container images, base images, CI runners, desktop installations, and application dependencies because image-processing tools are often bundled indirectly. Validate that policy enforcement works by attempting a controlled `-concatenate` operation against a path that policy should deny and confirming the operation is blocked after upgrade. Also verify that applications do not expose arbitrary command construction to users and that the processing account cannot read or write sensitive or service-critical paths through OS permissions alone.

Typical attack path

1. Identify an application, script, batch job, or desktop workflow that invokes the vulnerable image-processing tool.
2. Confirm the installed version is earlier than 7.1.2-26he / 7.1.2-26.
3. Supply or induce processing of attacker-controlled content or arguments that use the `-concatenate` operation.
4. Abuse the missing policy enforcement to access paths that should be denied by the configured security policy.
5. Leverage the unintended path access to disrupt processing, overwrite accessible files, fill storage, or otherwise cause denial of service within the permissions of the invoking process.

How to detect it

There are no public, high-confidence exploitation indicators provided for this issue. To check for possible prior exploitation, review endpoint process creation logs, EDR telemetry, shell history, application job logs, upload/conversion service logs, and container runtime logs for invocations of the image-processing binary using `-concatenate` with unusual absolute paths, parent directory traversal, paths outside expected temporary/output directories, or repeated failures around policy-denied paths. Correlate suspicious invocations with file creation, overwrite, truncation, or rapid growth events in directories that should not be touched by image-processing jobs. Also examine application error logs for policy bypass symptoms, denial-of-service conditions, unexpected conversion crashes, disk-full events, or repeated processing attempts against attacker-supplied files. Since exploitation requires local execution or user interaction, prioritize logs from systems where untrusted users can upload files, submit conversion jobs, or influence command parameters.

• -concatenate
• magick
• convert
• /etc/ImageMagick-7/policy.xml
• /etc/ImageMagick-6/policy.xml
• policy.xml
• attempt to perform an operation not allowed by the security policy
• not authorized
• cache resources exhausted
• No space left on device

What your security team should do

• Inventory all uses of the affected image-processing tooling across servers, containers, developer workstations, CI/CD jobs, and application upload pipelines.
• Patch to version 7.1.2-26 / 7.1.2-26he or later, prioritizing internet-facing or multi-user services that process untrusted content.
• Harden image-processing execution by sandboxing, using least-privilege service accounts, limiting filesystem mounts, and blocking arbitrary user-controlled command options.
• Review recent logs and process telemetry for unusual use of the `-concatenate` option, especially when combined with unexpected absolute paths or writes outside normal processing directories.
• Add regression tests that verify security policy restrictions are enforced for `-concatenate` and other file-accessing operations.
• Because EPSS is very low and there is no KEV listing, treat this as a targeted hardening and exposure-reduction priority rather than an emergency internet-wide exploitation event unless the product is exposed to untrusted input.