CVE-2026-55628

Summary

In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.

Affected Software

VendorProductVersion RangeStatus
ImageMagickImageMagick< 7.1.2-26affected

Weaknesses

  • CWE-73: CWE-73: External Control of File Name or Path
  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References