CVE-2026-106566mediumCWE-61

CVE-2026-106566: falha de média gravidade em ImageMagick

ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

Publicada em 07 out 2026

10Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4

probabilidade de exploração

—

exploração observada

nãonenhuma fonte reporta

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N

Produtos afetados

ImageMagick · ImageMagick

CVEs relacionadas — ImageMagick

No mesmo produto, das mais perigosas para as menos.

CVE-2025-55298HIGHImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code executionEPSS 4.5%CVE-2016-7523—CVE-2016-7523EPSS 2.7%CVE-2016-7524—CVE-2016-7524EPSS 2.2%CVE-2026-46522HIGHImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustionEPSS 1.9%CVE-2026-56379CRITICALImageMagick - Command Injection via SVG DecoderEPSS 1.6%CVE-2019-10131MEDIUMCVE-2019-10131EPSS 1.3%

Referências

https://github.com/ImageMagick/ImageMagick6/commit/11d2af00a948e9ca2919d9a8684d335a48484094 https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57 https://github.com/ImageMagick/ImageMagick/commit/48e5ce1779fc640a389f0020fd7d965d0c08236e https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54hm-vrmh-75qj