Cleartext transmission of sensitive information in ImageMagick - #VU158693
Published: November 3, 2026
Vulnerability identifier: #VU158693
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-319
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user on the local network to tamper with the resulting image by modifying pixel data.
The vulnerability exists due to cleartext transmission of sensitive information in ImageMagick's Distributed Pixel Cache when exchanging pixel data between a configured client and server. A remote user on the local network can modify pixel data on the network path between the client and server to alter the resulting image.
Affected software
ImageMagick
Remediation
Install security update from vendor's website.
ImageMagick - addressed in versions 6.9.13-60, 7.1.2-35