CVE-2026-105083: ImageMagick

Low severity, CVSS 3.9. EPSS: 0.1% chance of exploitation in the next 30 days.

ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.

Affected products

• ImageMagick ImageMagick: from 7.0.0-0, before 7.1.2-32 (fixed in 7.1.2-32); before 6.9.13-57 (fixed in 6.9.13-57)

Published 2026-10-03. Last modified 2026-10-06.