VULNERABILITY INTELLIGENCE

CVE-2026-61858

CVSS score3.3 LOW
EPSS probability0.25%
CISA KEVNot currently listed
Published2026-07-11
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.

Weakness classification

  • disclosure@vulncheck.com: CWE-59

Primary references