CVE-2026-105083: ImageMagick Policy Bypass Vulnerability

CVE-2026-105083 Overview

CVE-2026-105083 is a security policy bypass in ImageMagick affecting versions before 7.1.2-32 and 6.9.13-57. The flaw resides in the LoadPolicyCache function, which silently skips security policy rules when policy.xml uses an alternate DOCTYPE declaration. A valid DOCTYPE that does not terminate with ]> causes the parser to consume the remainder of the file. No policy rules are loaded, and restricted operations become allowed by default. The weakness is classified as [CWE-693] (Protection Mechanism Failure).

Critical Impact
Administrators relying on policy.xml to restrict dangerous coders, delegates, or resource limits may have those protections silently disabled, re-exposing ImageMagick to coder-based attacks the policies were designed to block.

Affected Products

ImageMagick versions prior to 7.1.2-32
ImageMagick 6 versions prior to 6.9.13-57
Downstream distributions and applications bundling the affected ImageMagick releases

Discovery Timeline

2026-10-03 - CVE-2026-105083 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105083

Vulnerability Analysis

ImageMagick enforces operational restrictions through policy.xml, which is loaded by LoadPolicyCache in MagickCore/policy.c. The parser recognizes a <!DOCTYPE keyword and advances through the document until it encounters the closing ]> sequence. The pre-patch logic assumed every DOCTYPE declaration contained an internal subset terminator.

When a DOCTYPE declaration omits the ]> terminator, the loop walks to end-of-file. The subsequent continue statement causes the loader to skip the remainder of policy.xml without raising a parsing error. The in-memory policy cache ends up empty, and ImageMagick falls back to permissive defaults for coder access, resource ceilings, and delegate execution.

Because the issue is an input-handling defect in the policy loader itself, it affects both MagickCore/color.c and MagickCore/configure.c, which share the same DOCTYPE parsing pattern. Operators who deployed hardened policies to mitigate historical ImageMagick coder abuse may unknowingly run with no restrictions.

Root Cause

The root cause is an unsafe assumption in DOCTYPE parsing. The original loop while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '\0')) treats a missing ]> as benign and falls through to continue, abandoning the rest of the configuration file instead of surfacing a parse error.

Attack Vector

Exploitation requires the ability to supply or influence an ImageMagick configuration file, typically a local attacker with write access to policy.xml, a packaging error, or a deployment pipeline that renders a crafted policy. Once the malformed DOCTYPE is present, ImageMagick starts without enforcing any configured policy and processes images under default permissions.

// Patch excerpt - MagickCore/color.c and MagickCore/configure.c
// Replaces the fragile DOCTYPE skip with a bracket- and quote-aware parser.
(void) CopyMagickString(keyword,token,MagickPathExtent);
if (LocaleNCompare(keyword,"<!DOCTYPE",9) == 0)
  {
    int
      bracket_depth = 0,
      quote = 0;

    /*
      DOCTYPE element.
    */
    for ( ; *q != '\0'; q++)
    {
      if (quote != 0)
        {
          if (*q == quote)
            quote=0;
        }
      else
        {
          if ((*q == '"') || (*q == '\''))
            quote=(*q);
          else
            if (*q == '[')
              bracket_depth++;
            else
              if (*q == ']')
                // ...tracks nested brackets and quotes

Source: ImageMagick commit 399d4bd

Detection Methods for CVE-2026-105083

Indicators of Compromise

A policy.xml file whose <!DOCTYPE ...> declaration does not end with ]> on any ImageMagick host.
identify -list policy returning an empty or near-empty policy set on systems that are expected to enforce restrictions.
Unexpected successful conversions involving coders previously blocked by policy (for example, MVG, MSL, EPHEMERAL, URL, HTTPS, FTP, PDF, LABEL).

Detection Strategies

Audit the installed ImageMagick version with convert -version or magick -version and compare against 7.1.2-32 and 6.9.13-57.
Parse policy.xml with a strict XML validator in configuration management to flag unterminated DOCTYPE subsets.
Run identify -list policy after each deployment and alert when the output does not match the expected baseline.

Monitoring Recommendations

Monitor file integrity on /etc/ImageMagick-*/policy.xml and other coder configuration files, capturing writer process and user.
Log and review ImageMagick invocations from web-facing services (uploads, thumbnailers, document converters) for coders that should be disabled.
Correlate ImageMagick process execution with outbound network connections to identify abuse of URL-based coders.

How to Mitigate CVE-2026-105083

Immediate Actions Required

Upgrade to ImageMagick 7.1.2-32 or 6.9.13-57 or later across all hosts, containers, and build pipelines.
Validate policy.xml syntax and confirm each DOCTYPE declaration terminates with ]> before deploying.
Re-verify effective policy with identify -list policy after upgrading and after any configuration change.

Patch Information

Upstream fixes land in MagickCore/policy.c, MagickCore/color.c, and MagickCore/configure.c for ImageMagick 7, and the equivalent magick/ sources for ImageMagick 6. Review the ImageMagick security advisory GHSA-jjp4-3fwf-393j, ImageMagick commit 1926ccf, ImageMagick commit 399d4bd, ImageMagick6 commit 402ebc5, ImageMagick6 commit da6022b2, and the VulnCheck advisory for full remediation guidance.

Workarounds

Replace any custom DOCTYPE in policy.xml with a minimal, well-formed declaration ending in ]>, or remove the DOCTYPE entirely.
Restrict write access to policy.xml and coder configuration directories to root or a dedicated service account.
Run ImageMagick workloads under a least-privilege user and inside a sandbox or container that blocks outbound network coders.

bash

# Verify policy enforcement is active after upgrade
magick -version | head -n 1
identify -list policy | head -n 20

# Reject policy.xml files with an unterminated DOCTYPE in CI
grep -nE '<!DOCTYPE' /etc/ImageMagick-7/policy.xml \
  && grep -q ']>' /etc/ImageMagick-7/policy.xml \
  || echo 'policy.xml DOCTYPE missing ]> terminator - block deployment'