ImageMagick CVE-2026-61858

Exploitation requires the attacker to have local system access with at least low-level privileges sufficient to invoke ImageMagick directly or through an application interface (PR:L per CVSS). The vulnerability is only triggerable through the APNG encoder or external delegate code paths, so the attacker must be able to control ImageMagick input that exercises these paths - either via direct CLI access or through an application (e.g., a web upload handler that processes APNG files using ImageMagick). Critically, the target deployment must be relying on ImageMagick's policy.xml as an access control mechanism; systems that do not configure path-based policies or that already enforce filesystem isolation at the OS level are not meaningfully impacted by this bypass. The attack vector is local (AV:L), so direct remote exploitation is not possible without a prior foothold or an application-layer trigger. Exploitation is limited to integrity impact (file writes to disallowed paths) with no confirmed confidentiality or availability consequences.

The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 4.8 (Medium), correctly reflecting that the attack surface is local and the impact is limited to integrity. The local attack vector (AV:L) and low-privilege prerequisite (PR:L) are the primary risk limiters - remote exploitation is not possible without a separate initial access vector such as a web upload endpoint that triggers ImageMagick processing. Environments relying on policy.xml as their primary access control layer (shared hosting, multi-tenant SaaS image pipelines) face real risk because the policy boundary is the protection being bypassed. Environments that sandbox ImageMagick at the OS level (containers, restricted service accounts, seccomp profiles) have inherent mitigations that reduce the practical impact. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. Overall this is a genuine but contextually bounded risk: high priority for shared-processing deployments, lower priority where OS-level isolation is already enforced.

A low-privileged user on a shared hosting platform or multi-tenant image processing service submits an APNG file or constructs an ImageMagick invocation that routes through the APNG encoder or an external delegate. By exploiting the missing policy validation, the crafted request resolves a write target to a path blocked by policy.xml - such as a web root directory or configuration path - and writes attacker-controlled content there. No public exploit code has been identified, but the technique is straightforward for anyone familiar with ImageMagick's coder and delegate architecture.