VulnerabilityAnalyzed

CVE-2026-56377

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies.

MEDIUM 4.8EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

CVSS 4.0: 4.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.16% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: imagemagick/imagemagick
Source: disclosure@vulncheck.com

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67pVendor Advisory
https://www.vulncheck.com/advisories/imagemagick-policy-bypass-via-incorrect-path-validationThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.