Vulnerability Description
ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Imagemagick | Imagemagick | < 6.9.13-40 |
Related Weaknesses (CWE)
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pwThird Party Advisory
FAQ
What is CVE-2026-25966?
CVE-2026-25966 is a vulnerability with a CVSS score of 5.9 (MEDIUM). ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard st...
How severe is CVE-2026-25966?
CVE-2026-25966 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-25966?
Check the references section above for vendor advisories and patch information. Affected products include: Imagemagick Imagemagick.