{"id":"CVE-2026-105823","title":"ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed","summary":"ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the app…","severity":"medium","cvss":4,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","cwe":["CWE-284"],"vendor":"ImageMagick","product":"ImageMagick","affected":["ImageMagick < 7.1.2-31","ImageMagick < 6.9.13-56"],"published":"2026-10-08","updated":"2026-10-08","sourceUpdated":"2026-10-08T20:50:49.260","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105823","references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-policy-bypass-in-cut-encoder","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-08T18:12:37.554456Z"},"ingestedAt":"2026-10-08T14:47:16.362Z","slug":"CVE-2026-105823","body":"## Overview\n\nImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":22,"depthScoreParts":{"impact":22,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}