CVE-2026-61858
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in ImageMagick before version 7.1.2-26 allows policy bypass in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by exploiting the APNG encoding process.
Risk Assessment
The organization is at risk of unauthorized file writes, potentially leading to data integrity compromise, privilege escalation, or further attacks on the infrastructure.
Recommendation
Immediately upgrade ImageMagick to version 7.1.2-26 or later, and review and tighten security policy configurations for the APNG encoder and external delegates.
Original NVD description (English source)
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.