Code Injection in ImageMagick - #VU158774
Published: November 3, 2026
Vulnerability identifier: #VU158774
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-94
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to inject additional headers or arbitrary code into output generated by ImageMagick.
The vulnerability exists due to improper control of code generation in the MAGICK, XBM, XPM and UIL encoders when encoding images using user-controlled filenames and directory names. A local user can manipulate the filename and directory in an accessible encoding location to inject additional headers or code into the generated output.
Affected software
ImageMagick
Remediation
Install security update from vendor's website.
ImageMagick - addressed in versions 6.9.13-60, 7.1.2-35