5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55628

CVE-2026-55628: ImageMagick: Policy Bypass in concatenate operation due to missing checks

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55628

CVE-2026-55628:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-x86	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-AnyCPU	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-x86	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.15.0	14.15.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described in GHSA-82mp-vp5c-9pf7, is a policy bypass in ImageMagick's -concatenate operation. The investigation led to commit dcba7ee9ffb0c5a22a458bf0c613bc818fcb4cc6, which explicitly references the advisory. This commit modifies the ConcatenateImages function in two separate files, MagickWand/deprecate.c and MagickWand/magick-cli.c. In both instances, the patch introduces calls to the IsPathAuthorized function to validate input and output file paths against the configured security policy. The absence of these checks in the vulnerable versions allowed an attacker to specify arbitrary file paths for reading and writing, bypassing policy restrictions. Therefore, the ConcatenateImages function is the vulnerable function, as it directly handles the file paths for the concatenation operation without proper authorization.

Vulnerable functions

ConcatenateImages

MagickWand/deprecate.c

The `ConcatenateImages` function in `MagickWand/deprecate.c` was missing authorization checks before performing file operations. The patch adds calls to `IsPathAuthorized` for both read and write operations, confirming that prior to this change, the function would process user-provided file paths without verifying them against the security policy.

ConcatenateImages

MagickWand/magick-cli.c

The `ConcatenateImages` function in `MagickWand/magick-cli.c` was missing authorization checks before performing file operations. The patch adds calls to `IsPathAuthorized` for both read and write operations, confirming that prior to this change, the function would process user-provided file paths without verifying them against the security policy.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-55628: ImageMagick: Policy Bypass in concatenate operation due to missing checks

CVE-2026-55628:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

5.5

5.5

CVE-2026-55628: ImageMagick: Policy Bypass in concatenate operation due to missing checks

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-55628: ImageMagick: Policy Bypass in concatenate operation due to missing checks

CVE-2026-55628:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

5.5

5.5

CVE-2026-55628: ImageMagick: Policy Bypass in concatenate operation due to missing checks

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI