ImageMagick: Policy bypass in CUT encoder
Summary
A missing security-policy check in the CUT encoder of ImageMagick allows a crafted local encoding operation to read data that the policy should deny. The same flaw can also cause a crash. An attacker needs a local account or process on the host, and the vulnerability is not exploitable remotely by itself.
Affected
- ImageMagick 7.x before 7.1.2-31 (CVE record: from 7.0.0)
- ImageMagick 6.x before 6.9.13-56
Fixed in
- 7.1.2-31
- 6.9.13-56
- Distribution backports: availability varies by vendor (Debian, Ubuntu, SUSE and Red Hat status differs). Check your vendor advisory.
Workaround
Unknown. No workaround is documented in the sources; updating is the only confirmed remedy.
- If patching is delayed, restrict which accounts can run ImageMagick on shared hosts.
- Review the policy.xml file and disable coders that are not needed.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: exploitation none, automatable no.
- Not listed in CISA KEV; no public proof of concept found.
Our recommendation
- Update ImageMagick to 7.1.2-31 or 6.9.13-56, or apply your distribution's fixed package.
- Check the ImageMagick version on hosts where non-administrative users or untrusted content can reach it, such as shared servers, CI runners and upload processing.
- Verify the CVSS score in the NVD record before final prioritisation; the vendor rates this as Moderate (4.0), while the CVE record lists 8.2.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r868-pmwh-fv2c github.com
- ImageMagick commit 768bdd0 (cut.c fix) github.com
- ImageMagick 7.1.2-31 release github.com
- ImageMagick6 commit ad178e4 github.com
- ImageMagick6 release 6.9.13-56 github.com
- Debian Security Tracker CVE-2026-106580 security-tracker.debian.org
- Ubuntu Security CVE-2026-106580 ubuntu.com
- OSV CVE-2026-105823 (alias) osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:55.
Original description (NVD)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
NVD references (5)
- https://github.com/ImageMagick/ImageMagick/commit/768bdd0dbb9a9ad743b6a6e557126b788b325970
- https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c
- https://github.com/ImageMagick/ImageMagick6/commit/ad178e41fce2afa6be2b91fb4e7f41c4c5448117
- https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.