CVE-2026-49219Medium· 5.5▾ SunlitImageMagick: Policy Bypass can read disallowed files via symlink
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.2%
An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink.
Magick.NET-Q16-AnyCPU < 14.14.0Magick.NET-Q16-HDRI-AnyCPU < 14.14.0Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.14.0Magick.NET-Q16-HDRI-arm64 < 14.14.0Magick.NET-Q16-HDRI-x64 < 14.14.0Magick.NET-Q16-HDRI-x86 < 14.14.0Magick.NET-Q16-OpenMP-arm64 < 14.14.0Magick.NET-Q16-OpenMP-x64 < 14.14.0Magick.NET-Q16-arm64 < 14.14.0Magick.NET-Q16-x64 < 14.14.0Magick.NET-Q16-x86 < 14.14.0Magick.NET-Q8-AnyCPU < 14.14.0Magick.NET-Q8-OpenMP-arm64 < 14.14.0Magick.NET-Q8-OpenMP-x64 < 14.14.0Magick.NET-Q8-arm64 < 14.14.0Magick.NET-Q8-x64 < 14.14.0Magick.NET-Q8-x86 < 14.14.0Upgrade to a patched release:
Magick.NET-Q16-AnyCPU 14.14.0Magick.NET-Q16-HDRI-AnyCPU 14.14.0Magick.NET-Q16-HDRI-OpenMP-arm64 14.14.0Magick.NET-Q16-HDRI-arm64 14.14.0Magick.NET-Q16-HDRI-x64 14.14.0Magick.NET-Q16-HDRI-x86 14.14.0Magick.NET-Q16-OpenMP-arm64 14.14.0Magick.NET-Q16-OpenMP-x64 14.14.0Magick.NET-Q16-arm64 14.14.0Magick.NET-Q16-x64 14.14.0Magick.NET-Q16-x86 14.14.0Magick.NET-Q8-AnyCPU 14.14.0Magick.NET-Q8-OpenMP-arm64 14.14.0Magick.NET-Q8-OpenMP-x64 14.14.0Magick.NET-Q8-arm64 14.14.0Magick.NET-Q8-x64 14.14.0Magick.NET-Q8-x86 14.14.0Connected by shared product, vendor, weakness, or advisory.
GHSA-56m6-8q75-f2rwMedium· 4.7ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219
CVE-2026-53467Medium· 5.3ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
CVE-2026-56370Low· 3.3ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts
GHSA-cvhv-g4rq-3hmwLow· 3.3ImageMagick: Memory Leak when providing invalid options to the cli
CVE-2026-53466Medium· 6.5ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow
GHSA-76q6-2p6h-xjqrLow· 1.8ImageMagick: Heap Buffer Over-Write in X11 import with crafted window title