CVE-2026-105083

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-32 ImageMagick versions prior to 6.9.13-57

Description A security policy bypass exists in the LoadPolicyCache() function. This occurs when the policy.xml file utilizes an alternate DOCTYPE that does not end in ]>, causing the parser to consume the remainder of the file. Consequently, security policy rules are silently skipped, allowing restricted operations to be executed.

Recommendations Update to version 7.1.2-32 or later. Update to version 6.9.13-57 or later.