CVE-2026-28689
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker to bypass security checks in ImageMagick, enabling them to read or write files they shouldn't have access to by tricking the software into using a different file than intended. To exploit this, the attacker needs to create a symbolic link (symlink) that swaps the intended file with a malicious one before the software opens it.
Technical Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 10, 2026
28 days ago
Last Modified
Mar 12, 2026
26 days ago
Vendor
imagemagick
Product
imagemagick
Related Vulnerabilities
An attacker can create a specially crafted image that, when processed by vulnerable versions of ImageMagick using the wavelet denoise feature, can lead to unintended memory changes, potentially allowing them to execute arbitrary code. This issue affects versions prior to 7.1.2-16 and 6.9.13-41, so updating to these versions or later is essential to mitigate the risk.
This vulnerability allows an attacker to cause an application using ImageMagick to read data from memory that it shouldn't, potentially exposing sensitive information. It occurs when processing specially crafted images with the bilateral blur feature, and it affects versions prior to 7.1.2-16.
This vulnerability allows an attacker to exploit a flaw in ImageMagick's UHDR encoder, potentially leading to unauthorized access or control over the system by writing data outside the intended memory space. It affects versions prior to 7.1.2-16, so users must upgrade to this version or later to protect against this risk.
This vulnerability allows an attacker to crash the ImageMagick software or potentially execute malicious code by sending a specially crafted image that overflows a fixed-size memory area. It affects versions prior to 7.1.2-16 and 6.9.13-41, so users should update to these versions or later to protect against this risk.
This vulnerability allows an attacker to crash the ImageMagick software or potentially execute harmful code by sending a specially crafted PNG image with an excessively large profile. It affects versions prior to 7.1.2-16 and 6.9.13-41, so using an updated version is crucial to avoid exploitation.