NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
.NET
.NET NuGet
Not in CISA KEV
MEDIUM severity

CVE-2026-25966 — Magick.NET-Q16-AnyCPU

MEDIUMFix: ImageMagick/ImageMagick@8d4c67a

CVE-2026-25966 is a medium-severity (CVSS 5.9) CWE-284 vulnerability in Magick.NET-Q16-AnyCPU. A fix is available for Magick.NET-Q16-AnyCPU — see the affected versions and patch details below.

ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

Also known asGHSA-xwc6-v6g8-pw2h
Published
Updated
Affected
17 pkgs
Patched
17 / 17
Exploits
None indexed
Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25966.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs4th percentile — riskier than 4% of all scored CVEsHighest risk
0.00%0.22%0.44%0.65%0.0%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

17 pkgs affected
.NETMagick.NET-Q16-AnyCPU.NETMagick.NET-Q16-HDRI-AnyCPU.NETMagick.NET-Q16-HDRI-OpenMP-arm64.NETMagick.NET-Q16-HDRI-arm64.NETMagick.NET-Q16-HDRI-x64.NETMagick.NET-Q16-HDRI-x86.NETMagick.NET-Q16-OpenMP-arm64.NETMagick.NET-Q16-OpenMP-x64+9 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.

Affected Packages

17 total 17 fixed
EcosystemPackageVulnerable rangeFix
.NETNuGetMagick.NET-Q16-AnyCPUall versions14.10.3dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3
.NETNuGetMagick.NET-Q16-HDRI-AnyCPUall versions14.10.3dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3
.NETNuGetMagick.NET-Q16-HDRI-OpenMP-arm64all versions14.10.3dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3
.NETNuGetMagick.NET-Q16-HDRI-arm64all versions14.10.3dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3
.NETNuGetMagick.NET-Q16-HDRI-x64all versions14.10.3dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3
.NETNuGetMagick.NET-Q16-HDRI-x86all versions14.10.3dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3

Affected Products

1 product · 2 configurations
Application
imagemagickimagemagick
≥ 7.0.0-0 && < 7.1.2-15
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Magick.NET-Q16-AnyCPU, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update Magick.NET-Q16-AnyCPU to 14.10.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25966 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This MODERATE impact flaw in ImageMagick allows a security policy bypass through the use of `fd:<n>` pseudo-filenames, enabling unauthorized access to standard input/output despite the "secure" policy. Red Hat Enterprise Linux 6 ELS and 7 ELS, as well as community projects like Fedora and EPEL, are affected by this…

Workaround published by Red Hat
To mitigate this issue, modify the ImageMagick security policy file, typically located at `/etc/ImageMagick-X/policy.xml` (where X is the version), to explicitly deny access to `fd:` pseudo-filenames. Add a policy rule similar to `<policy domain="delegate" rights="none" pattern="fd:*" />` within the `<policymap>` section. This change will prevent ImageMagick from processing `fd:` paths, thereby closing the bypass. A restart of any services utilizing ImageMagick may be required for the policy change to take effect.
Source: Red Hat security advisory for CVE-2026-25966 (CC BY 4.0)

Frequently Asked Questions

ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to
O3 Security · Impact-Aware SCA

Is CVE-2026-25966 in your dependencies?

Find it across NuGet, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-25966: Magick.NET-Q16 — Fixed in 14.10.3