CVE-2026-116140

A flaw was found in ImageMagick. An attacker could bypass administrator-defined security policies by convincing the application to process specially crafted input that triggers a delegate invocation. This issue occurs due to incorrect parsing of delegate commands, allowing programs explicitly restricted or blocked in the security configuration to be executed.

This vulnerability is rated as having a Low severity for Red Hat because successful exploitation requires convincing a user or service to parse an untrusted file and only allows the execution of an already present external helper rather than granting arbitrary privilege escalation. Core Red Hat Enterprise Linux releases (such as RHEL 8 and 9) do not ship ImageMagick, confining enterprise exposure to legacy ELS systems (RHEL 6 and RHEL 7). Community builds available through EPEL and Fedora already include the fix. Furthermore, the issue only presents a risk in environments where explicit delegate execution restrictions have been configured in security policies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.