EUVD-2026-94405Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Crafted images are typically processed from remote uploads with no auth or interaction, so AV:N/PR:N/UI:N; impact is reading prohibited data only, so C:H, I:N, A:N (NVD's AV:L noted as conflicting).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
AnalysisAI
ImageMagick 7.x before 7.1.2-31 and 6.x before 6.9.13-56 can be induced to bypass a security policy configured with the 'coder' domain, allowing a crafted image to load a coder that the policy was meant to block and thereby read data that policy prohibits. The flaw matters only to deployments that actually configure a coder-based deny policy - typically security-conscious hosting, CI, or image-processing pipelines that pass untrusted user-supplied images into ImageMagick - where the bypass defeats the intended hardening and exposes file content to confidentiality loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only against ImageMagick installations (prior to 7.1.2-31 / 6.9.13-56) that have configured a security policy using the coder domain to restrict specific coders - the bypass defeats that policy, so deployments without such a coder policy gain nothing to bypass. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Composite signals point to a MODERATE, situational priority rather than an urgent one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to ImageMagick 7.1.2-31 or ImageMagick 6.9.13-56 (or later) on the applicable branch; the fixes land in GitHub commits 82f373fedb3425c83a239103ab86f4fa86fd49ac and dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd for 7.x and ac85c8e0a319b1eaf4c3d05d326605f5bae723d6 and c54667bfe605ebdc17c23cb70a26dbe00b338222 for ImageMagick6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today