CERT/CC Advises Restrictive ImageMagick Policies for Untrusted Images
Tech GuruQuick Answer
Inventory untrusted-image paths, including AI preprocessing and post-processing. Apply product-specific fixes, allow only required formats and operations, and verify the effective ImageMagick policy.
Confirm Scope And Apply The Supported Remediation
What to do now: Map uploads, fetched images, datasets and model outputs to ImageMagick calls, installed delegates, policy.xml files, process users and writable storage. Determine whether dangerous coders or delegates are enabled and whether sensitive files, shared temporary storage or host mounts are reachable. Follow the integrating vendor’s guidance. Disable unnecessary coders and delegates, including MSL, MVG, PS, EPS and PDF where not required; isolate processing with minimal filesystem privileges. Confirm effective policy, reject prohibited formats in controlled tests, and test required conversions. Retain policy files, application versions, processing logs and evidence of unexpected file writes.
Last verified: 2026-11-13 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Applications and pipelines invoking ImageMagick with permissive coders or delegates |
|---|---|
| Advisory | VU#580079 |
| CVEs | No single CVE set is assigned to all integrations; see product-specific references. |
| Authoritative release date | 2026-11-12 — November 12, 2026 at 18:12:09 UTC, from CERT/CC first-publication metadata. |
| Authority revision date | No separate revision date is provided by the authority. |
| Affected versions | Deployments that process attacker-controlled SVG or PostScript content under insufficiently restrictive policies. Exposure depends on coders, delegates, process permissions, temporary storage and each integrating application; no universal affected-version range is provided. |
| Fixed version | Product-specific vendor updates where available, plus a deployment-specific allowlist policy and restricted image-processing environment; no universal ImageMagick version is designated as a complete fix |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | CERT/CC does not confirm exploitation in the wild; individual vendor statements must be assessed separately.; no exploitation claim is inferred. |
What Changed
CERT/CC describes ImageTragick2 file-read/write paths through SVG coder invocation and Ghostscript handling. In some configurations, writable executable content can turn file access into code execution. The note cites CVE-2026-65640 for a WordPress-reported variant; it does not assign one CVE to all integrations.
What To Validate Now
- Inventory. Map uploads, fetched images, datasets and model outputs to ImageMagick calls, installed delegates, policy.xml files, process users and writable storage.
- Establish applicability. Determine whether dangerous coders or delegates are enabled and whether sensitive files, shared temporary storage or host mounts are reachable.
- Remediate. Follow the integrating vendor’s guidance. Disable unnecessary coders and delegates, including MSL, MVG, PS, EPS and PDF where not required; isolate processing with minimal filesystem privileges.
- Validate. Confirm effective policy, reject prohibited formats in controlled tests, and test required conversions. Retain policy files, application versions, processing logs and evidence of unexpected file writes.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Updating ImageMagick alone or selecting its bundled secure policy may be insufficient. Disabling formats can break legitimate workflows; review required formats and isolate necessary delegates before deployment.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
