ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. (CVE-2026-109277)

The vulnerability in ImageMagick prior to version 7.1.2-32 involves the -script operation lacking proper validation of file descriptor handling. This deficiency enables an attacker with local privileges to close file descriptors that were not opened by the current operation, effectively bypassing configured security policies. The issue is identified as CWE-404 (Improper Resource Shutdown or Release). The CVSS v3.1 base score is 3.3, reflecting low impact on confidentiality and integrity but some impact on availability. There is no information about known exploits or vendor-provided patches in the input data.

Attackers with local privileges can exploit this vulnerability to close file descriptors improperly, which may lead to denial of service or disruption of normal operation by circumventing security policies. There is no direct impact on confidentiality or integrity reported. The overall impact is limited availability degradation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users and monitor for suspicious use of the -script operation. Avoid running untrusted scripts with ImageMagick.