{"id":"CVE-2026-105823","aliases":["CLSA-2026-1792591008","CLSA-2026-1792591590","CLSA-2026-1792591674","DEBIAN-CVE-2026-105823","EUVD-2026-95010","GHSA-74jf-772x-83jq","GHSA-r868-pmwh-fv2c","openSUSE-SU-2026:12139-1"],"status":"rejected","title":"ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT...","description":"This CVE ID has been rejected as a duplicate.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-400"],"published":"2026-10-07T15:54:22.839Z","modified":"2026-10-28T10:51:07Z","fixes":[{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:7.1.2.31+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.68-7.0.11.el7_9.tuxcare.els7"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:6.9.11.60+dfsg-1.6","8:6.9.11.60+dfsg-1.6+deb12u1","8:6.9.11.60+dfsg-1.6+deb12u10","8:6.9.11.60+dfsg-1.6+deb12u11","8:6.9.11.60+dfsg-1.6+deb12u12","8:6.9.11.60+dfsg-1.6+deb12u13","8:6.9.11.60+dfsg-1.6+deb12u2","8:6.9.11.60+dfsg-1.6+deb12u3","8:6.9.11.60+dfsg-1.6+deb12u4","8:6.9.11.60+dfsg-1.6+deb12u5","8:6.9.11.60+dfsg-1.6+deb12u6","8:6.9.11.60+dfsg-1.6+deb12u7","8:6.9.11.60+dfsg-1.6+deb12u8","8:6.9.11.60+dfsg-1.6+deb12u9","8:6.9.12.20+dfsg1-1","8:6.9.12.20+dfsg1-1.1","8:6.9.12.20+dfsg1-1.2","8:6.9.12.98+dfsg1-1","8:6.9.12.98+dfsg1-2","8:6.9.12.98+dfsg1-3","8:6.9.12.98+dfsg1-4","8:6.9.12.98+dfsg1-5","8:6.9.12.98+dfsg1-5.1","8:6.9.12.98+dfsg1-5.1~exp1","8:6.9.12.98+dfsg1-5.2","8:6.9.13.12+dfsg1-1","8:7.1.1.33+dfsg1-1","8:7.1.1.33+dfsg1-2","8:7.1.1.39+dfsg1-1","8:7.1.1.39+dfsg1-2","8:7.1.1.39+dfsg1-3","8:7.1.1.43+dfsg1-1","8:7.1.1.46+dfsg1-1","8:7.1.1.47+dfsg1-1","8:7.1.1.47+dfsg1-2","8:7.1.2.1+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.15+dfsg1-2","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.19+dfsg1-1","8:7.1.2.21+dfsg1-1","8:7.1.2.23+dfsg1-1","8:7.1.2.24+dfsg1-1","8:7.1.2.25+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.26+dfsg1-1","8:7.1.2.27+dfsg1-1","8:7.1.2.29+dfsg2-1","8:7.1.2.3+dfsg1-1","8:7.1.2.31+dfsg1-1","8:7.1.2.7+dfsg1-1","8:7.1.2.8+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.43+dfsg1-1+deb13u1","8:7.1.1.43+dfsg1-1+deb13u10","8:7.1.1.43+dfsg1-1+deb13u11","8:7.1.1.43+dfsg1-1+deb13u12","8:7.1.1.43+dfsg1-1+deb13u2","8:7.1.1.43+dfsg1-1+deb13u3","8:7.1.1.43+dfsg1-1+deb13u4","8:7.1.1.43+dfsg1-1+deb13u5","8:7.1.1.43+dfsg1-1+deb13u6","8:7.1.1.43+dfsg1-1+deb13u7","8:7.1.1.43+dfsg1-1+deb13u8","8:7.1.1.43+dfsg1-1+deb13u9","8:7.1.1.46+dfsg1-1","8:7.1.1.47+dfsg1-1","8:7.1.1.47+dfsg1-2","8:7.1.2.1+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.15+dfsg1-2","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.19+dfsg1-1","8:7.1.2.21+dfsg1-1","8:7.1.2.23+dfsg1-1","8:7.1.2.24+dfsg1-1","8:7.1.2.25+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.26+dfsg1-1","8:7.1.2.27+dfsg1-1","8:7.1.2.29+dfsg2-1","8:7.1.2.3+dfsg1-1","8:7.1.2.31+dfsg1-1","8:7.1.2.7+dfsg1-1","8:7.1.2.8+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.31+dfsg1-1"}]}],"versions":["8:7.1.1.43+dfsg1-1","8:7.1.1.46+dfsg1-1","8:7.1.1.47+dfsg1-1","8:7.1.1.47+dfsg1-2","8:7.1.2.1+dfsg1-1","8:7.1.2.12+dfsg1-1","8:7.1.2.13+dfsg1-1","8:7.1.2.15+dfsg1-1","8:7.1.2.15+dfsg1-2","8:7.1.2.16+dfsg1-1","8:7.1.2.18+dfsg1-1","8:7.1.2.19+dfsg1-1","8:7.1.2.21+dfsg1-1","8:7.1.2.23+dfsg1-1","8:7.1.2.24+dfsg1-1","8:7.1.2.25+dfsg1-1","8:7.1.2.25+dfsg1-2","8:7.1.2.26+dfsg1-1","8:7.1.2.27+dfsg1-1","8:7.1.2.29+dfsg2-1","8:7.1.2.3+dfsg1-1","8:7.1.2.7+dfsg1-1","8:7.1.2.8+dfsg1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2.33-1.1"}]}],"bundled":13}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105823","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-cut-encoder","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-74jf-772x-83jq"},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792591008.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106579","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106580","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55628","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792591590.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792591674.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105823.json","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31","tags":["web"]},{"url":"https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106580.json","tags":["advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/768bdd0dbb9a9ad743b6a6e557126b788b325970","tags":["fix"]},{"url":"https://github.com/ImageMagick/ImageMagick6/commit/ad178e41fce2afa6be2b91fb4e7f41c4c5448117","tags":["fix"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105823","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105827","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-105823","description":"This CVE ID has been rejected as a duplicate.","status":"rejected","published":"2026-10-08T14:10:27.322Z","modified":"2026-10-09T13:03:11.996Z","updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-95010","description":"This CVE ID has been rejected as a duplicate.","status":"published","published":"2026-10-08T14:10:27Z","modified":"2026-10-09T13:03:11Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T17:27:25.459601Z"}],"ghsa":[{"id":"GHSA-74jf-772x-83jq","title":"ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT...","description":"ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.","status":"published","published":"2026-10-08T15:33:01Z","modified":"2026-10-08T15:33:07Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:12:57.235839Z"}],"nvd":[{"id":"CVE-2026-105823","description":"Rejected reason: This CVE ID has been rejected as a duplicate.","status":"rejected","published":"2026-10-08T15:17:34.14Z","modified":"2026-10-18T22:10:00.1Z","updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-105823","title":"ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder","description":"ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.","status":"published","published":"2026-10-08T14:10:27.322Z","modified":"2026-10-16T17:26:59.449992771Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"CVE-2026-106580","title":"ImageMagick: Policy Bypass in CUT encoder","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.","status":"published","published":"2026-10-07T15:54:22.839Z","modified":"2026-10-28T10:51:07.417188673Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-284","CWE-400"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"DEBIAN-CVE-2026-105823","description":"ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.","status":"published","published":"2026-10-08T15:17:34.14Z","modified":"2026-10-09T09:00:07.053602929Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"CLSA-2026-1792591008","title":"ImageMagick: Fix of 8 CVEs","description":"- CVE-2026-105081: deny dangling/looping symlinks in path policy checks\n- CVE-2026-105403: check the coder policy against the coder actually used (also CVE-2026-106579)\n- CVE-2026-105404: escape labels written into PostScript/PDF output\n- CVE-2026-105823: apply the path policy to CUT palette files (also CVE-2026-106580)\n- CVE-2026-106566: honour MAGICK_SHRED_PASSES when deciding on unique symlinks\n- CVE-2026-55628: apply the path policy to convert -concatenate inputs and output","status":"published","published":"2026-10-21T13:57:06Z","modified":"2026-10-26T09:43:37.96777784Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792591590","title":"ImageMagick: Fix of 7 CVEs","description":"- CVE-2026-105081: deny dangling/looping symlinks in path policy checks\n- CVE-2026-105403: check the coder policy against the coder actually used (also CVE-2026-106579)\n- CVE-2026-105404: escape labels written into PostScript/PDF output\n- CVE-2026-105823: apply the path policy to CUT palette files (also CVE-2026-106580)\n- CVE-2026-106566: honour MAGICK_SHRED_PASSES when deciding on unique symlinks\n- CVE-2026-55628: apply the path policy to convert -concatenate inputs and output","status":"published","published":"2026-10-21T20:01:56Z","modified":"2026-10-26T09:43:45.454927728Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792591674","title":"ImageMagick: Fix of 8 CVEs","description":"- CVE-2026-105081: deny dangling/looping symlinks in path policy checks\n- CVE-2026-105403: check the coder policy against the coder actually used (also CVE-2026-106579)\n- CVE-2026-105404: escape labels written into PostScript/PDF output\n- CVE-2026-105823: apply the path policy to CUT palette files (also CVE-2026-106580)\n- CVE-2026-106566: honour MAGICK_SHRED_PASSES when deciding on unique symlinks\n- CVE-2026-55628: apply the path policy to convert -concatenate inputs and output","status":"published","published":"2026-10-21T14:08:12Z","modified":"2026-10-26T09:43:29.871649924Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"openSUSE-SU-2026:12139-1","title":"ImageMagick-7.1.2.33-1.1 on GA media","description":"These are all security issues fixed in the ImageMagick-7.1.2.33-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-16T17:23:12.957683838Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}