CVE-2026-105823

ImageMagick: ImageMagick: Security policy bypass via CUT encoder

Published Oct 8, 2026 CVSS 3.1 · 4.0 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected as a duplicate.

No data.

No data available yet.

No solution or workaround provided in the CVE record

No advisories available

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c
https://nvd.nist.gov/vuln/detail/CVE-2026-105823
https://www.cve.org/CVERecord?id=CVE-2026-105823
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-cut-encoder

History

Type	Values Removed	Values Added
Weaknesses	CWE-284
Metrics	cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Type	Values Removed	Values Added
Description	ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.	This CVE ID has been rejected as a duplicate.
Title	ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder	ImageMagick: ImageMagick: Security policy bypass via CUT encoder
CPEs	cpe:2.3:a:imagemagick:imagemagick::::::::
Metrics	cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Type	Values Removed	Values Added
Weaknesses		CWE-749
References		https://nvd.nist.gov/vuln/detail/CVE-2026-105823 https://www.cve.org/CVERecord?id=CVE-2026-105823
Metrics	threat_severity `None`	threat_severity `Moderate`

Type	Values Removed	Values Added
Description		ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.
Title		ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-284
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-cut-encoder
Metrics		cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'}` cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}`