CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder

Medium 4.0 Published 7 Oct 2026 Updated 7 Oct 2026

Attackers can bypass security policies in the CUT encoder to read restricted data or cause crashes via crafted local encoding operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-106580?

CVE-2026-106580 is a medium-severity vulnerability in Imagemagick Imagemagick, published on 7 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Weakness: CWE-400, CWE-284

Which versions are affected by CVE-2026-106580?

It affects 1 product.

Products include Imagemagick Imagemagick.

How do I fix CVE-2026-106580?

Upgrade to a fixed version.

Is CVE-2026-106580 being exploited?

There is no known exploitation of CVE-2026-106580 in the wild and no public exploit code.

All Imagemagick Imagemagick vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-106580, ECHO-0047-ec7b-fcbf, MINI-hpg6-vfpx-r85q, UBUNTU-CVE-2026-106580.