Executive brief
ImageMagick is a software suite used for displaying, converting, and editing image files. A security flaw in its concatenation feature allows the software to bypass its own security policies, potentially allowing unauthorized reading or writing of files on the system. This could lead to the exposure of sensitive data or the unauthorized modification of system files by a local user.
Technical details
A policy bypass vulnerability exists in ImageMagick's '-concatenate' operation due to missing authorization checks (CWE-862). The root cause is the failure to validate file paths against the defined security policy during concatenation tasks, allowing for external control of file names or paths (CWE-73). A local attacker with low privileges can exploit this to read from or write to restricted filesystem locations that should be disallowed by the ImageMagick security policy. This impact is primarily on confidentiality (High) and integrity (Low). The vulnerability is addressed in Magick.NET version 14.15.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-x86 < 14.15.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
- ImageMagick,versions: Magick.NET-Q8-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-x86 < 14.15.0
Timeline
- 2026-06-26: disclosed
- 2026-07-01: advisory: NVD Published
- 2026-07-24: patched: GitHub Advisory Published/Reviewed