PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25965 ImageMagick CVE debrief

CVE-2026-25965 is a high-severity vulnerability in ImageMagick, a free and open-source software used for editing and manipulating digital images. The vulnerability has a CVSS score of 8.6 and is classified as HIGH. It was published on February 24, 2026, and modified on June 30, 2026. The vulnerability allows local file disclosure (LFI) due to a path traversal issue in ImageMagick's path security policy. This issue enables attackers to bypass policy rules and access sensitive files.

Vendor
ImageMagick
Product
Unknown
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-24
Original CVE updated
2026-07-15
Advisory published
2026-02-24
Advisory updated
2026-07-15

Who should care

Organizations using ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 should be concerned about this vulnerability. Additionally, users who have applied the policy-secure.xml configuration but have not updated their ImageMagick versions are also at risk. It is essential for these organizations to take immediate action to mitigate the vulnerability.

Technical summary

The vulnerability is caused by ImageMagick's path security policy being enforced on the raw filename string before the filesystem resolves it. This allows policy rules to be bypassed, enabling local file disclosure. The issue can be mitigated by updating to ImageMagick versions 7.1.2-15 or 6.9.13-40. Furthermore, adding specific configurations to one's policy can prevent writing to files and ensure that the policy is enforced correctly.

Defensive priority

High priority should be given to updating ImageMagick to versions 7.1.2-15 or 6.9.13-40. Additionally, organizations should review and update their policy configurations to prevent potential bypasses.

Recommended defensive actions

  • Update ImageMagick to version 7.1.2-15 or 6.9.13-40.
  • Review and update policy configurations to prevent potential bypasses.
  • Monitor for any suspicious activity related to ImageMagick.
  • Perform regular vulnerability assessments and penetration testing.
  • Implement compensating controls, such as restricting access to sensitive files.

Evidence notes

The vulnerability was published on February 24, 2026, and modified on June 30, 2026. The CVSS score is 8.6, and the severity is classified as HIGH. The vulnerability affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25965 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25965

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25965 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25965

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7

    [email protected] - Third Party Advisory

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:5573

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-25965

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.