CVE-2026-106566 ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check
A local privileged workflow can bypass symlink cleanup policies to overwrite files with random data if the MAGICK_SHRED_PASSES environment variable is set.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-106566?
CVE-2026-106566 is a medium-severity vulnerability in Imagemagick Imagemagick, published on 7 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
Which versions are affected by CVE-2026-106566?
It affects 1 product.
Products include Imagemagick Imagemagick.
How do I fix CVE-2026-106566?
Upgrade to a fixed version.
Is CVE-2026-106566 being exploited?
There is no known exploitation of CVE-2026-106566 in the wild and no public exploit code.
Other vulnerabilities in Imagemagick Imagemagick
Sources
Also known as DEBIAN-CVE-2026-106566, ECHO-5709-3aba-fe4f, GHSA-54hm-vrmh-75qj, MINI-qjfh-g32p-mqvc, UBUNTU-CVE-2026-106566.