ImageMagick versions prior to 6.9.13-58 and 7.x prior to 7.1.2-33 fail to properly account for symbolic link resolution during the IsRightsAuthorizedByName security policy check, allowing a local attacker who can create a symlink to point at a policy‑restricted path to bypass configured restrictions. This vulnerability effectively changes which files the policy applies to, potentially enabling hidden file access or modification, but it does not grant remote code execution or cross‑system impact.

All installations of ImageMagick that use the affected software versions run with a locally writable filesystem. The vulnerability applies to ImageMagick releases 6.9.13-58 and earlier, and to any 7.x release older than 7.1.2-33. The affected product is ImageMagick:ImageMagick as listed by the CNA.

The CVSS score of 2.0 indicates low severity, and the EPSS score is not available for this vulnerability, suggesting limited exploitation frequency at present. The vulnerability is local, requiring the ability to create a symlink in a directory where ImageMagick processes files. Because it is not listed in CISA KEV, no widely known exploits have been documented. Overall risk remains low, but the impact of policy bypass may be significant in environments with strict access controls.