Low
ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder
Type: advisorySources: OSV
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-105823, CVE-2026-106580
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 22:36 UTC · Revision 1
Source evidence
ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder
core-osv · Original sourcePublished 8 Oct 2026, 14:10 UTC
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.
osv:CVE-2026-105823
Complete source record
{
"id": "4c808f20b8ffaec93a3dc8bd1e0980f43c10692df110ac1aa20c8b41f0c13b32",
"url": "https://osv.dev/vulnerability/CVE-2026-105823",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder",
"summary": "ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.",
"evidence": "osv:CVE-2026-105823",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-105823",
"aliases": [
"CVE-2026-105823",
"CVE-2026-106580",
"GHSA-r868-pmwh-fv2c"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "fb965f1b54a65ddb633f8c2eac4452c782c66d7f"
}
],
"database_specific": {
"source": "AFFECTED_FIELD",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "7.1.2-31"
}
]
}
}
],
"versions": [
"7.1.2-30",
"7.1.2-29",
"7.1.2-28",
"7.1.2-27",
"7.1.2-26",
"7.1.2-25",
"7.1.2-24",
"7.1.2-23",
"7.1.2-22",
"7.1.2-21",
"7.1.2-20",
"7.1.2-19",
"7.1.2-18",
"7.1.2-17",
"7.1.2-16",
"7.1.2-15",
"7.1.2-14",
"7.1.2-13",
"7.1.2-12",
"7.1.2-11",
"7.1.2-10",
"7.1.2-9",
"7.1.2-8",
"7.1.2-7",
"7.1.2-6",
"7.1.2-5",
"7.1.2-3",
"7.1.2-2",
"7.1.2-1",
"7.1.2-0",
"7.1.1-47",
"7.1.1-46",
"7.1.1-45",
"7.1.1-44",
"7.1.1-43",
"7.1.1-41",
"7.1.1-40",
"7.1.1-39",
"7.1.1-38",
"7.1.1-37",
"7.1.1-36",
"7.1.1-35",
"7.1.1-34",
"7.1.1-33",
"7.1.1-32",
"7.1.1-31",
"7.1.1-30",
"7.1.1-29",
"7.1.1-28",
"7.1.1-27",
"7.1.1-26",
"7.1.1-25",
"7.1.1-24",
"7.1.1-23",
"7.1.1-22",
"7.1.1-21",
"7.1.1-20",
"7.1.1-19",
"7.1.1-18",
"7.1.1-17",
"7.1.1-16",
"7.1.1-15",
"7.1.1-14",
"7.1.1-13",
"7.1.1-12",
"7.1.1-11",
"7.1.1-10",
"7.1.1-9",
"7.1.1-8",
"7.1.1-7",
"7.1.1-6",
"7.1.1-5",
"7.1.1-4",
"7.1.1-3",
"7.1.1-2",
"7.1.1-1",
"7.1.1-0",
"7.1.0-62",
"7.1.0-61",
"7.1.0-60",
"7.1.0-59",
"7.1.0-58",
"7.1.0-57",
"7.1.0-56",
"7.1.0-55",
"7.1.0-54",
"7.1.0-53",
"7.1.0-52",
"7.1.0-51",
"7.1.0-50",
"7.1.0-49",
"7.1.0-48",
"7.1.0-47",
"7.1.0-46",
"7.1.0-45",
"7.1.0-44",
"7.1.0-43",
"7.1.0-42",
"7.1.0-41",
"7.1.0-40",
"7.1.0-39",
"7.1.0-38",
"7.1.0-37",
"7.1.0-36",
"7.1.0-35",
"7.1.0-34",
"7.1.0-33",
"7.1.0-32",
"7.1.0-31",
"7.1.0-30",
"7.1.0-29",
"7.1.0-28",
"7.1.0-27",
"7.1.0-26",
"7.1.0-25",
"7.1.0-24",
"7.1.0-23",
"7.1.0-22",
"7.1.0-21",
"7.1.0-20",
"7.1.0-19",
"7.1.0-18",
"7.1.0-17",
"7.1.0-16",
"7.1.0-15",
"7.1.0-14",
"7.1.0-13",
"7.1.0-12",
"7.1.0-11",
"7.1.0-10",
"7.1.0-9",
"7.1.0-8",
"7.1.0-7",
"7.1.0-6",
"7.1.0-5",
"7.1.0-4",
"7.1.0-3",
"7.1.0-2",
"7.1.0-1",
"7.1.0-0",
"7.0.11-14",
"7.0.11-13",
"7.0.11-12",
"7.0.11-11",
"7.0.11-10",
"7.0.11-9",
"7.0.11-8",
"7.0.11-7",
"7.0.11-6",
"7.0.11-5",
"7.0.11-4",
"7.0.11-3",
"7.0.11-2",
"7.0.11-1",
"7.0.11-0",
"7.0.10-62",
"7.0.10-61",
"7.0.10-60",
"7.0.10-59",
"7.0.10-58",
"7.0.10-57",
"7.0.10-56",
"7.0.10-55",
"7.0.10-54",
"7.0.10-53",
"7.0.10-52",
"7.0.10-51",
"7.0.10-50",
"7.0.10-49",
"7.0.10-48",
"7.0.10-47",
"7.0.10-46",
"7.0.10-45",
"7.0.10-44",
"7.0.10-43",
"7.0.10-42",
"7.0.10-41",
"7.0.10-40",
"7.0.10-39",
"7.0.10-38",
"7.0.10-37",
"7.0.10-36",
"7.0.10-35",
"7.0.10-34",
"7.0.10-33",
"7.0.10-32",
"7.0.10-31",
"7.0.10-30",
"7.0.10-29",
"7.0.10-28",
"7.0.10-27",
"7.0.10-26",
"7.0.10-25",
"7.0.10-24",
"7.0.10-23",
"7.0.10-22",
"7.0.10-21",
"7.0.10-20",
"7.0.10-19",
"7.0.10-18",
"7.0.10-17",
"7.0.10-16",
"7.0.10-15",
"7.0.10-14",
"7.0.10-13",
"7.0.10-12",
"7.0.10-11",
"7.0.10-10",
"7.0.10-9",
"7.0.10-8",
"7.0.10-7",
"7.0.10-6",
"7.0.10-5",
"7.0.10-4",
"7.0.10-3",
"7.0.10-2",
"7.0.10-1",
"7.0.10-0",
"7.0.9-27",
"7.0.9-26",
"7.0.9-25",
"7.0.9-24",
"7.0.9-23",
"7.0.9-22",
"7.0.9-21",
"7.0.9-20",
"7.0.9-19",
"7.0.9-18",
"7.0.9-17",
"7.0.9-16",
"7.0.9-15",
"7.0.9-14",
"7.0.9-13",
"7.0.9-12",
"7.0.9-11",
"7.0.9-10",
"7.0.9-9",
"7.0.9-8",
"7.0.9-7",
"7.0.9-6",
"7.0.9-5",
"7.0.9-4",
"7.0.9-2",
"7.0.9-1",
"7.0.9-0",
"7.0.8-68",
"7.0.8-67",
"7.0.8-66",
"7.0.8-65",
"7.0.8-64",
"7.0.8-63",
"7.0.8-62",
"7.0.8-61",
"7.0.8-60",
"7.0.8-59",
"7.0.8-58",
"7.0.8-57",
"7.0.8-56",
"7.0.8-55",
"7.0.8-54",
"7.0.8-53",
"7.0.8-52",
"7.0.8-51",
"7.0.8-50",
"7.0.8-49",
"7.0.8-48",
"7.0.8-47",
"7.0.8-46",
"7.0.8-45",
"7.0.8-44",
"7.0.8-43",
"7.0.8-42",
"7.0.8-41",
"7.0.8-40",
"7.0.8-39",
"7.0.8-38",
"7.0.8-37",
"7.0.8-36",
"7.0.8-35",
"7.0.8-34",
"7.0.8-33",
"7.0.8-32",
"7.0.8-31",
"7.0.8-30",
"7.0.8-29",
"7.0.8-28",
"7.0.8-27",
"7.0.8-26",
"7.0.8-25",
"7.0.8-24",
"7.0.8-23",
"7.0.8-22",
"7.0.8-21",
"7.0.8-20",
"7.0.8-19",
"7.0.8-18",
"7.0.8-17",
"7.0.8-16",
"7.0.8-15",
"7.0.8-14",
"7.0.8-13",
"7.0.8-12",
"7.0.8-11",
"7.0.8-10",
"7.0.8-9",
"7.0.8-8",
"7.0.8-7",
"7.0.8-6",
"7.0.8-5",
"7.0.8-4",
"7.0.8-3",
"7.0.8-2",
"7.0.8-1",
"7.0.8-0",
"7.0.7-39",
"7.0.7-38",
"7.0.7-37",
"7.0.7-36",
"7.0.7-35",
"7.0.7-34",
"7.0.7-33",
"7.0.7-32",
"7.0.7-31",
"7.0.7-30",
"7.0.7-29",
"7.0.7-28",
"7.0.7-27",
"7.0.7-26",
"7.0.7-25",
"7.0.7-24",
"7.0.7-23",
"7.0.7-22",
"7.0.7-21",
"7.0.7-20",
"7.0.7-19",
"7.0.7-18",
"7.0.7-17",
"7.0.7-16",
"7.0.7-15",
"7.0.7-14",
"7.0.7-13",
"7.0.7-12",
"7.0.7-11",
"7.0.7-10",
"7.0.7-9",
"7.0.7-8",
"7.0.7.7",
"7.0.7-6",
"7.0.7-5",
"7.0.7-4",
"7.0.7-3",
"7.0.7-2",
"7.0.7-1",
"7.0.7-0",
"7.0.6-9",
"7.0.6-8",
"7.0.6-7",
"7.0.6-6",
"7.0.6-5",
"7.0.6-4",
"7.0.6-3",
"7.0.6-2",
"7.0.6-1",
"7.0.6-0",
"7.0.5-10",
"7.0.5-9",
"7.0.5-8",
"7.0.5-7",
"7.0.5-6",
"7.0.5-5",
"7.0.5-4",
"7.0.5-3",
"7.0.5-2",
"7.0.5-1",
"7.0.5-0",
"7.0.4-10",
"7.0.4-9",
"7.0.4-8",
"7.0.4-7",
"7.0.4-6",
"7.0.4-5",
"7.0.4-4",
"7.0.4-3",
"7.0.4-2",
"7.0.4-1",
"7.0.4-0",
"7.0.3-10",
"7.0.3-9",
"7.0.3-8",
"7.0.3-7",
"7.0.3-6",
"7.0.3-5",
"7.0.3-4",
"7.0.3-3",
"7.0.3-2",
"7.0.3-1",
"7.0.3-0",
"7.0.2-10",
"7.0.2-9",
"7.0.2-8",
"7.0.2-7",
"7.0.2-6",
"7.0.2-5",
"7.0.2-4",
"7.0.2-3",
"7.0.2-2",
"7.0.2-1",
"7.0.2-0",
"7.0.1-10",
"7.0.1-9",
"7.0.1-8",
"7.0.1-7",
"7.0.1-6",
"7.0.1-5",
"7.0.1-4",
"7.0.1-3",
"7.0.1-2",
"7.0.1-1",
"7.0.1-0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105823.json"
}
}
],
"modified": "2026-10-16T17:26:59.449992771Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105823.json",
"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c",
"https://nvd.nist.gov/vuln/detail/CVE-2026-105823",
"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-cut-encoder"
],
"provider_metadata": {
"cwe_ids": [
"CWE-284"
],
"cna_assigner": "VulnCheck",
"unresolved_ranges": [
{
"source": "AFFECTED_FIELD",
"extracted_events": [
{
"fixed": "6.9.13-56"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105823.json"
}
},
"related_cves": [
{
"value": "CVE-2026-105823",
"evidence": "/id"
},
{
"value": "CVE-2026-106580",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 347587,
"published_at": "2026-10-08T14:10:27.322+00:00"
}