CVE-2026-105083: ImageMagick ImageMagick

Affected products, as the CNA wrote them
Vendor	Product	Versions
ImageMagick	ImageMagick	affected 7.0.0-0 to before 7.1.2-32 custom affected before 6.9.13-57 custom Other versions: unaffected

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
1.8	Low	4.0	CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	CNA (VulnCheck)Used for this record
3.9	Low	3.1	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L	CNA (VulnCheck)

CISA KEV Not listed.
EPSS 0.0011, the 1st percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 3 Oct 2026. New records show when each source confirmed them.

Sources

CVE List: CVE-2026-105083
NVD: CVE-2026-105083

References from the CNA

github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j vendor-advisory
github.com/ImageMagick/ImageMagick/commit/1926ccf119141c26274c120d1899dffae19b0c71 patch
github.com/ImageMagick/ImageMagick/commit/399d4bd3b081f44c7fef78153f65e8cdebed9f1a patch
github.com/ImageMagick/ImageMagick6/commit/da6022b2efe6cce8a2fd8f9e51188a45a3b9d558 patch
github.com/ImageMagick/ImageMagick6/commit/402ebc5353e569234908962cbdf451531ff66a57 patch
github.com/ImageMagick/ImageMagick/blob/7.1.2-31/MagickCore/policy.c#L1138-L1145 technical-description
github.com/ImageMagick/ImageMagick product
www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-security-policy-bypass-via-policy-xml-doctype third-party-advisory

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.