CVE-2026-25966

A flaw was found in ImageMagick. The "secure" security policy, intended to prevent reading and writing from standard streams, can be bypassed. An attacker can exploit this by using fd:<n> pseudo-filenames, which are not properly blocked by the policy. This allows the attacker to circumvent the intended security restrictions, potentially leading to unauthorized access to standard input/output (stdin/stdout) and subsequent information disclosure or data manipulation.

This MODERATE impact flaw in ImageMagick allows a security policy bypass through the use of fd:<n> pseudo-filenames, enabling unauthorized access to standard input/output despite the "secure" policy. Red Hat Enterprise Linux 6 ELS and 7 ELS, as well as community projects like Fedora and EPEL, are affected by this vulnerability. Exploitation requires an attacker to provide a specially crafted image or command that leverages this bypass.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, modify the ImageMagick security policy file, typically located at /etc/ImageMagick-X/policy.xml (where X is the version), to explicitly deny access to fd: pseudo-filenames. Add a policy rule similar to <policy domain="delegate" rights="none" pattern="fd:*" /> within the <policymap> section. This change will prevent ImageMagick from processing fd: paths, thereby closing the bypass. A restart of any services utilizing ImageMagick may be required for the policy change to take effect.