CVE-2026-25966: ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access
The shipped “secure” security policy includes a rule intended to prevent reading/writing from standard streams:
<policy domain="path" rights="none" pattern="-"/>
However, ImageMagick also supports fd: pseudo-filenames (e.g., fd:0, fd:1). This path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of “no stdin/stdout”.
To resolve this, users can add the following change to their security policy.
<policy domain="path" rights="none" pattern="fd:*"/>
And this will also be included in ImageMagick’s more secure policies by default.
References
- github.com/ImageMagick/ImageMagick
- github.com/ImageMagick/ImageMagick/commit/8d4c67a90ae458fb36393a05c0069e9123ac174c
- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pw2h
- github.com/advisories/GHSA-xwc6-v6g8-pw2h
- github.com/dlemstra/Magick.NET/releases/tag/14.10.3
- nvd.nist.gov/vuln/detail/CVE-2026-25966
Code Behaviors & Features
Detect and mitigate CVE-2026-25966 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →