CVE-2026-25966

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-15 ImageMagick versions prior to 6.9.13-40

Description ImageMagick is software used for editing and manipulating digital images. The software’s security policy, intended to prevent reading/writing from standard streams, was bypassed due to the use of fd: pseudo-filenames. Specifically, the secure policy templates did not block this path form, allowing a bypass of the protection goal of preventing standard input/output access.

Recommendations Update to ImageMagick version 7.1.2-15 or later. Update to ImageMagick version 6.9.13-40 or later. As a workaround, manually add the necessary change to your security policy.