Log in Start free

Vulnerability · Published Feb 24, 2026 · Assigned by GitHub_M

CVE-2026-25966ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

Medium 5.9

In plain English

A medium-severity improper access control in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.2%top 95.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22imagemagick7.1.2.15-r0ALPINE-CVE-2026-25966
Alpine:v3.23imagemagick7.1.2.15-r0ALPINE-CVE-2026-25966
Alpine:v3.24imagemagick7.1.2.15-r0ALPINE-CVE-2026-25966
Debian:13imagemagick8:7.1.1.43+dfsg1-1+deb13u6DEBIAN-CVE-2026-25966
Debian:13imagemagick8:7.1.1.43+dfsg1-1+deb13u6DSA-6158-1
Debian:14imagemagick8:7.1.2.15+dfsg1-1DEBIAN-CVE-2026-25966
NuGetmagick.net-q16-anycpu14.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-arm6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-hdri-anycpu14.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-hdri-arm6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-hdri-openmp-arm6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-hdri-x6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-hdri-x8614.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-openmp-arm6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-openmp-x6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-openmp-x8614.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q16-x6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q8-anycpu14.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q8-arm6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q8-openmp-arm6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q8-openmp-x6414.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-q8-x8614.10.3GHSA-xwc6-v6g8-pw2h
NuGetmagick.net-qmagick.net-q16-x8616-x6414.10.3GHSA-xwc6-v6g8-pw2h
Ubuntu:25.10imagemagickno fix listedUBUNTU-CVE-2026-25966
Ubuntu:26.10imagemagickno fix listedUBUNTU-CVE-2026-25966

Affected products (as reported)

VendorProductVersions
ImageMagick ImageMagick >= 7.0.0, < 7.1.2-15< 6.9.13-40

Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References