CVE-2026-61859 ImageMagick CVE debrief

Who should care

Users of ImageMagick versions before 7.1.2-26 and 6.9.13-51 should be aware of this policy bypass vulnerability. This vulnerability could potentially allow attackers to read sensitive files that are disallowed by the security policy. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed and addressed.

Technical summary

The vulnerability exists in the -script operation of ImageMagick. Due to missing security policy checks, an attacker could potentially exploit this vulnerability to read files from paths that are otherwise disallowed by the configured security policy. The vulnerability has a CVSS score of 4.8 and a severity of MEDIUM. Affected product deployments should be identified and owners assigned for follow-up. Official advisories and CVE records should be reviewed to validate affected scope, severity, and vendor guidance.

Defensive priority

Medium priority should be given to updating ImageMagick to versions 7.1.2-26 or later and 6.9.13-51 or later. Users should also review their security policies and ensure they are properly configured to prevent unauthorized file access.

Recommended defensive actions

• Update ImageMagick to version 7.1.2-26 or later
• Update ImageMagick to version 6.9.13-51 or later
• Review and configure security policies to prevent unauthorized file access
• Monitor for any suspicious activity related to ImageMagick
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide information on the vulnerability. The vendor advisory and third-party advisory provide additional information on the vulnerability and potential mitigations. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected deployments, review official advisories, and monitor for suspicious activity related to ImageMagick. Additional information from other sources may be necessary to fully understand the vulnerability.

Official resources