5.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
CVE-2026-55628: ImageMagick's -concatenate operation opens its output file and each input file without a security-policy authorization check (CWE-73 / CWE-862), allowing reads and writes to paths that a restrictive policy.xml is intended to forbid. Medium severity (CVSS 5.5).
This package tracks the legacy ImageMagick 6 line. The vulnerable code path — ConcatenateImages() opening files via fopen without an IsPathAuthorized() check — is present in the current ImageMagick 6 release (6.9.13-52) and on ImageMagick 6 main. The fix exists only in ImageMagick 7 (7.1.2-26), which adds IsPathAuthorized(WritePolicyRights / ReadPolicyRights) guards around those file opens; the ImageMagick 6 branch has not backported it.
Upgrading to ImageMagick 7 is a major-version change incompatible with the ImageMagick 6 version stream, so no version bump within the 6.x line remediates this. Remediation is pending an upstream ImageMagick 6 backport of the ConcatenateImages policy check (the required IsPathAuthorized primitives are already present in 6.9.13-52).
Reference:
Status