CVE-2026-105083

Katalog CVE

CVSS 3.9 · Low EPSS 0,12%

Kerentanan Protection Mechanism Failure. Skor CVSS 3.1 3.9 (Low) menurut vulncheck.com.

Deskripsi (NVD)

ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.

Rincian

Terbit di NVD

3 Oktober 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

3.9 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ImageMagick/ImageMagick
• https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/MagickCore/policy.c#L1138-L1145
• https://github.com/ImageMagick/ImageMagick/commit/1926ccf119141c26274c120d1899dffae19b0c71
• https://github.com/ImageMagick/ImageMagick/commit/399d4bd3b081f44c7fef78153f65e8cdebed9f1a
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j
• https://github.com/ImageMagick/ImageMagick6/commit/402ebc5353e569234908962cbdf451531ff66a57
• https://github.com/ImageMagick/ImageMagick6/commit/da6022b2efe6cce8a2fd8f9e51188a45a3b9d558
• https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-security-policy-bypass-via-poli...