CVE-2020-29599: Debian Linux

High severity, CVSS 7.8. EPSS: 7.5% chance of exploitation in the next 30 days.

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

Affected products

• Debian Debian Linux: version 9.0 only
• ImageMagick ImageMagick: from 6.9.8-1, before 6.9.11-40 (fixed in 6.9.11-40); from 7.0.5-3, before 7.0.10-40 (fixed in 7.0.10-40)

Published 2020-12-07. Last modified 2026-06-17.