CVE-2026-116140Low· 3.3▾ SunlitA flaw was found in ImageMagick. An attacker could bypass administrator-defined security policies by convincing the application to process specially crafted input that triggers a delegate invocation. This issue occurs due to incorrect pars…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.1%
A flaw was found in ImageMagick. An attacker could bypass administrator-defined security policies by convincing the application to process specially crafted input that triggers a delegate invocation. This issue occurs due to incorrect parsing of delegate commands, allowing programs explicitly restricted or blocked in the security configuration to be executed.
ImageMagick: ImageMagick: Security policy bypass via flawed delegate invocation parsing — rated Low by Red Hat. Released 2026-10-25.
Affected:
No fix planned:
Out of support scope
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116124High· 7.8libgsf: libgsf: Arbitrary code execution via heap-based buffer overflow in OLE2 parser (CVE-2026-116124)
CVE-2026-116141Medium· 5.3ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)
CVE-2026-116148Low· 3.6ImageMagick: ImageMagick: Command injection via unvalidated drawing options in MVG encoder (CVE-2026-116148)
CVE-2026-116149High· 7.8ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images (CVE-2026-116149)
CVE-2026-116152Medium· 5.3ImageMagick: ImageMagick: Denial of Service via memory leak in MAT decoder (CVE-2026-116152)
CVE-2026-116153Low· 2.5ImageMagick: ImageMagick: Denial of Service via heap-based buffer overflow in convex-hull calculations (CVE-2026-116153)