Technical impact
ImageMagick before 7.1.2-26 contains a policy bypass that allows the APNG encoder to write files to any path without enforcing configured policy rules due to missing validation checks. This flaw is a form of improper access control, enabling a malicious actor to create or overwrite files in locations that should be protected, such as configuration files, system binaries, or web‑root directories. The weakness is classified as CWE-22 and CWE-59.
Affected Systems
ImageMagick released by ImageMagick. All pre‑7.1.2-26 versions are vulnerable; upgrading to 7.1.2-26 or later eliminates the flaw.
Risk and Exploitability
The CVSS score of 4.8 indicates moderate severity, the EPSS score is less than 1% indicating a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must cause ImageMagick to process an APNG file – this could occur locally or via an application that performs image conversion – so the attack vector is likely local or application‑level. Because the flaw permits arbitrary file writes, it could be used for privilege escalation or malicious code execution if critical files are overwritten.
Debian DLA