CVE-2026-105404 ImageMagick CVE debrief

Who should care

Defenders responsible for ImageMagick installations, security teams, and developers using ImageMagick in their applications should assess exposure and prioritize updates. This includes verifying and updating ImageMagick installations to version 7.1.2-31 or later, assessing exposure in environments using ImageMagick, and monitoring for potential exploitation attempts. Operators, platform administrators, vulnerability management teams, and security teams may

Why it matters

CVE-2026-105404 is a code injection vulnerability in ImageMagick's PostScript coders. Defenders should prioritize verifying and updating ImageMagick installations, assessing exposure, and monitoring for potential exploitation attempts.

• Verify and update ImageMagick installations to prevent potential code injection
• Assess exposure in environments using ImageMagick
• Monitor for potential exploitation attempts

Technical summary

ImageMagick before 7.1.2-31 contains a code injection vulnerability in its PostScript coders. Attackers can supply crafted values that embed arbitrary PostScript code into files generated by these coders. The vulnerability has a CVSS score of 6 and a severity of MEDIUM. ImageMagick versions before 6.9.13-56 and 7.x before 7.1.2-31 are affected. Defenders should prioritize verifying and updating ImageMagick installations to version 7.1.2-31 or later, and assess exposure in their environments. The CVE record and source item provide details on the code injection vulnerability in ImageMagick's PostScript coders.

Defensive priority

Defenders should prioritize verifying and updating ImageMagick installations to version 7.1.2-31 or later, and assess exposure in their environments.

Recommended defensive actions

• Verify ImageMagick installations and update to version 7.1.2-31 or later
• Assess exposure in environments using ImageMagick
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the code injection vulnerability in ImageMagick's PostScript coders. However, limited information is available on potential exploitation or affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.