Executive brief
ImageMagick, a widely used software suite for editing and converting images, contains a security flaw in how it handles certain animated image formats (APNG). This vulnerability allows a user with local access to bypass security policies and write files to restricted locations on the system. While the risk is categorized as low, it could potentially be used to overwrite sensitive configuration files or system data if the software is not updated.
Technical details
A policy bypass vulnerability exists in ImageMagick's APNG encoder and external delegates due to missing validation checks. The flaw is classified under CWE-59 (Improper Link Resolution) and CWE-862 (Missing Authorization), where the software fails to properly enforce configured security policies during the encoding process. An attacker with local access and low privileges can exploit this to write files to paths that should be restricted by ImageMagick's security policy. The issue is resolved in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published by maintainers
- 2026-07-11: disclosed: CVE published in NVD dataset