ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy… (CVE-2026-105081)

The vulnerability in ImageMagick prior to versions 6.9.13-58 and 7.1.2-33 involves improper handling of symbolic links in the IsRightsAuthorizedByName security policy check. This allows local attackers with the ability to create symbolic links to circumvent policy restrictions by redirecting the check to a policy-restricted path. The CVSS 3.1 base score is 3.6, reflecting low severity with local attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact.

Local attackers who can create symbolic links may bypass configured security policies in ImageMagick, potentially accessing or manipulating files or resources that should be restricted by the policy. The impact is limited to confidentiality and integrity with no effect on availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, restrict local user permissions to prevent unauthorized symbolic link creation and monitor for suspicious activity related to policy bypass attempts.