CLSA-2026-1791905425 ImageMagick: Fix of 17 CVEs

CVE-2026-106571: check the pixel cache nexus size calculation for overflow - CVE-2026-106573: limit macro expansion in the MVG renderer - CVE-2026-106578: fix an invalid free in the MVG decoder by correcting the CheckPrimitiveExtent call - CVE-2026-106579: check the coder name against the...

Linux Distros Unpatched Vulnerability : CVE-2026-105403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 allows a security policy bypass when a policy uses coder, rather than module, as its domain. An attacker ca...

DEBIAN-CVE-2026-105403

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 allows a security policy bypass when a policy uses coder, rather than module, as its domain. An attacker can supply a crafted image to evade coder-based policy restrictions, causing ImageMagick to process formats the administrator intended to...

CVE-2026-105403

...

CVE-2026-105403 ImageMagick before 7.1.2-31 Security Policy Bypass via Coder Domain

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 allows a security policy bypass when a policy uses coder, rather than module, as its domain. An attacker can supply a crafted image to evade coder-based policy restrictions, causing ImageMagick to process formats the administrator intended to...

CVE-2026-105403

Removed by vendor...

CVE-2026-105403

...

CVE-2026-105403

A security policy bypass vulnerability exists in ImageMagick versions before 6.9.13-56 and 7.x before 7.1.2-31 . The root cause is a flaw where policies using the coder domain, rather than the module domain, can be bypassed. An attacker can provide a crafted image to evade these restrictions, for...

CVE-2026-106579

A flaw was found in ImageMagick. This issue allows an attacker to bypass access controls and read restricted files, leading to unauthorized information disclosure. By supplying a specially crafted image to a system configured with security policies that restrict image decoders the coder domain, t...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-106579

The ImageMagick software is vulnerable to a security policy bypass before versions 7.1.2-31 and 6.9.13-56 . A crafted image can bypass security policies that utilize coder as its domain, potentially allowing an attacker to read data prohibited by the policy. This occurs because the software may p...