ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-551"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106579.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.2-31"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "82f373fedb3425c83a239103ab86f4fa86fd49ac"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "7.1.2-31",
"range": [
{
"fixed": "fb965f1b54a65ddb633f8c2eac4452c782c66d7f"
}
],
"source": "REFERENCES_TAG"
}
]
}
{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.9.13-56"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "ac85c8e0a319b1eaf4c3d05d326605f5bae723d6"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "c54667bfe605ebdc17c23cb70a26dbe00b338222"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "6.9.13-56",
"range": [
{
"fixed": "2f16e94c5ecb1256496a20d1ecdcaf53aeb1a4ce"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-106579.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "97850244167161552325751942613108206385",
"length": 9394
},
"id": "CVE-2026-106579-0f0f24c0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/82f373fedb3425c83a239103ab86f4fa86fd49ac",
"target": {
"file": "MagickCore/constitute.c",
"function": "ReadImage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170210480563486023477713949685327676013",
"299488933941396271989351851379788718127",
"9213598401273239093200763557209185352",
"24054468205632860685056793112232417463"
],
"threshold": 0.9
},
"id": "CVE-2026-106579-3e949a5b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/82f373fedb3425c83a239103ab86f4fa86fd49ac",
"target": {
"file": "MagickCore/constitute.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "305203594180066259782187356716011014416",
"length": 11674
},
"id": "CVE-2026-106579-5909173f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/ac85c8e0a319b1eaf4c3d05d326605f5bae723d6",
"target": {
"file": "magick/constitute.c",
"function": "ReadImage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"325805480730702627442466574954463981853",
"260021579478897505282273794908143868677",
"9213598401273239093200763557209185352",
"24054468205632860685056793112232417463",
"12580323787159925426557849180375667064",
"288787450689396374082003667763965117355",
"191282739231855387908017940573629359533",
"100120432651820147775396398863150883668"
],
"threshold": 0.9
},
"id": "CVE-2026-106579-654d2868",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222",
"target": {
"file": "magick/constitute.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"335346096272914452949552459793214149310",
"299488933941396271989351851379788718127",
"9213598401273239093200763557209185352",
"24054468205632860685056793112232417463",
"230257439526706448477853535693052517272",
"83897435214175606142671481051355910835",
"191282739231855387908017940573629359533",
"27757103260907953948318214875746206878"
],
"threshold": 0.9
},
"id": "CVE-2026-106579-74543b30",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd",
"target": {
"file": "MagickCore/constitute.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "263330529204272727879184763385897913690",
"length": 9395
},
"id": "CVE-2026-106579-7678b937",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd",
"target": {
"file": "MagickCore/constitute.c",
"function": "ReadImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "59558144841394824506776179303714834064",
"length": 6355
},
"id": "CVE-2026-106579-aa8114f8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222",
"target": {
"file": "magick/constitute.c",
"function": "WriteImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "327791684216100762259914529868777138401",
"length": 11675
},
"id": "CVE-2026-106579-e0a972d7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222",
"target": {
"file": "magick/constitute.c",
"function": "ReadImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "127977911534107891246927377679970667898",
"length": 5824
},
"id": "CVE-2026-106579-e7f8d8bb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/dcdbbf4278fab20a32a4ad80e64cb95c368ca8dd",
"target": {
"file": "MagickCore/constitute.c",
"function": "WriteImage"
}
}
]
"2026-10-16T10:09:53Z"