CVE-2026-109277
Received Received - Intake

Policy Bypass in ImageMagick via -script File Descriptor Handling

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109277
EUVD
EUVD-2026-97579

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ImageMagick before version 7.1.2-32 has a policy bypass flaw in the -script operation. This happens because the software fails to properly check file descriptor handling. Attackers can exploit this to close file descriptors not opened by the current operation, bypassing configured security policies.

Detection Guidance

To detect this vulnerability, check the installed ImageMagick version using 'convert --version' or 'magick --version'. If the version is below 7.1.2-32, the system is vulnerable. Monitor for unusual file descriptor closures during -script operations.

Impact Analysis

This vulnerability could allow attackers to bypass security policies, potentially leading to unauthorized access or execution of malicious scripts. It primarily affects systems using vulnerable versions of ImageMagick for image processing tasks.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access or manipulation of sensitive data through policy bypass. Attackers exploiting this flaw may close file descriptors improperly, leading to unauthorized data exposure or corruption. Such incidents could violate data protection requirements under these regulations.

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-32 or later to address the policy bypass vulnerability in the -script operation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109277. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart