CVE-2026-109277

LowCVSS 3.3/10Last modified Nov 3, 2026

Description

ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
ImageMagick	ImageMagick	>= 7.0.0-0, < 7.1.2-32

References

https://github.com/ImageMagick/ImageMagick/commit/ce92ae07c2ca2c20c131eaf6da6da734c1cafce0Patch
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vv56-wmgw-m36wPatch, Vendor Advisory
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-policy-bypass-via-script-operationPatch, Third Party Advisory

Timeline

Published: Oct 12, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1092783.7ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocat CVE-2026-1092792.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous read CVE-2026-109288.8Script injection in Headless in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML CVE-2026-1092802.5ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails du CVE-2026-1092814.4ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads CVE-2026-1092822.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal m CVE-2026-1092835.4Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only fro CVE-2026-1092844.3Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in CVE-2026-1092855.0Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base CVE-2026-1092868.1Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to stea CVE-2026-1092874.3Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dir CVE-2026-1092886.4Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link UR