ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-284",
"CWE-400"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106580.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.2-31"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "768bdd0dbb9a9ad743b6a6e557126b788b325970"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "7.1.2-31",
"range": [
{
"fixed": "fb965f1b54a65ddb633f8c2eac4452c782c66d7f"
}
],
"source": "REFERENCES_TAG"
}
]
}
{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.9.13-56"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "ad178e41fce2afa6be2b91fb4e7f41c4c5448117"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "6.9.13-56",
"range": [
{
"fixed": "2f16e94c5ecb1256496a20d1ecdcaf53aeb1a4ce"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-106580.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "162749104580470061237091881857081014120",
"length": 8991
},
"id": "CVE-2026-106580-31e29b07",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/ad178e41fce2afa6be2b91fb4e7f41c4c5448117",
"target": {
"file": "coders/cut.c",
"function": "ReadCUTImage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"79467083002327775669276325563666249691",
"253261904170805969216432791145697922994",
"249940723129560741250292887087936631558",
"5187809419839350959180812649871040160",
"330494998413138145819850929461434165436",
"100840445412807258056003343722421944278",
"145419649779474204356575133746077068050",
"333990571587640199130033119359281845143",
"21768409341508641590107465294886774492",
"285047820177251741434072098195842557723",
"170020805788787542101590990848317546807",
"254640329093349369689065873271770823099",
"315473104111186857374962334173265580333",
"80048884491124852650273286054430384196",
"294211044887595371300524002193312445607",
"133078914779736013338845934436926796440",
"146463953985568744589698557747633758335",
"195331429737106291294225146089996166671",
"13363434203171936748746681647503794471",
"283728498469261506240512251131484950353",
"280031938939983792312485984336032124945",
"65085351482730483689028554405311447646",
"196151137738298008734767670427245134957",
"294510017095241354583248904173718282",
"116584664205692095912791929848289765590",
"184882080671822447818151505546663964278",
"272739886971920122151742234807030787971",
"210633725028398701382166961676283464967",
"317143059198639140353664310877853131308",
"154170745400797324132815540850006086228",
"222753815739076605463829998592043993485",
"295826724390093298791224524751064883936",
"163378473579259394271349566186058812487",
"150659377038083014240322463990040545528",
"204020748812174995170609000334956348148",
"172538125155379942609994092550933094616",
"74054565678133455050289700001943011749",
"110226177868665844741454918437843202970",
"204020748812174995170609000334956348148",
"211362835310959510892823487420989131279",
"22740249724982814493421683900167184421",
"279473259356032972146583102240528972050",
"46153913715656947543604078579437428009",
"165892347874492132823708791410485242593",
"208611510358629114054716990556762213593",
"209494411843847590532020921203333630454",
"271202875103203706868041496288631508940",
"166381407058946578153023839411953263581",
"188569597832177938075719048668128063701",
"40975315829486749829725176611122691001",
"179986250420908952843138634800255113781",
"143770226044721514266941805881558869132",
"335016752582660613795177591375736620260",
"191318083249730547432218750785189474982",
"301106992340074434764709848448801302729",
"279961317342196035425554820446092901969",
"163454305730622909411828327964030966099",
"230754844182930751817600293133592122593",
"75763416721585624891841502007437304761",
"153915455683267602565025294852849601311",
"205841227333750780777874377626766175655",
"15400018991913390327855292821294478646",
"338344545778997903429981248067651557738",
"325811663461504841397974708420147408412",
"168992383491402542495328970927252719018",
"185054778172280647662881489786884200470",
"3367278387215187596269154942727469512",
"174430560709795845905603975393090723855",
"134310997842149691702107503259749752853",
"72601427617302532688189347712159575073",
"272219939183913824951210081877040893092",
"142793992524866932292939625801766716347",
"214543269218276614126047126559979009612",
"208344499878816953274924488428452240601",
"45052745713842345289087290694150125923",
"300865579671083380435502285322690909554",
"234710255865473389894137863152073271705",
"85703771790573387731945751041018980836",
"61892764038983991119490552154498627512",
"226160088934699013722716025317465159403",
"176211798485646718836313572814970013580",
"321145011498361355806139277886097594617",
"171967404576667787030012050217770224464",
"224885986203179274375647307365228932453",
"18317610676404397260344761223332448865",
"335502649202321508085238239480567207472",
"28197969604205160354161476926547090287",
"194980450699299418918397155213003686821",
"231566129481391793607537174087277547601",
"301610097998262470891609465723116817655",
"177662197751607835325190723554695188126",
"317121994975660944918106201239612673965",
"13923452767824119615534287787733861393",
"199763831260405197014188278223662111177",
"60266470799162650946904377172317217177",
"160678020665054337031846952953333493176",
"133285651872340135154385080012934269173",
"292145319867431178326079403073782158572",
"324273655050925223797620296536218655343",
"20228076452328695582141755317202610657",
"210774104008616766971843061318189737232",
"69314317923955409685091279743678124842",
"177153674787730961720434365503009489789",
"302257159971395369341958816263484342764",
"298668478242448146384543759733125210127",
"62124495078708503752547169233658353889",
"7238001345150229140581993789098529321",
"311004976724735581287163347925863647499",
"324152813119159729248981103902168543172",
"256419451468346462027171596681105317555",
"73325500006823378641225453985848404625",
"55314202498003073648599955734710776744"
],
"threshold": 0.9
},
"id": "CVE-2026-106580-3e799a8a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/ad178e41fce2afa6be2b91fb4e7f41c4c5448117",
"target": {
"file": "coders/cut.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "176091022411997000589265080699954850208",
"length": 9091
},
"id": "CVE-2026-106580-a1b08a12",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/768bdd0dbb9a9ad743b6a6e557126b788b325970",
"target": {
"file": "coders/cut.c",
"function": "ReadCUTImage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"79467083002327775669276325563666249691",
"253261904170805969216432791145697922994",
"249940723129560741250292887087936631558",
"5187809419839350959180812649871040160",
"330494998413138145819850929461434165436",
"34793087615257265348436182872040232994",
"200318360185942861827939165557164520351",
"245343595151683028300194581855045053874",
"21872918713681313528901551554428426365",
"285047820177251741434072098195842557723",
"170020805788787542101590990848317546807",
"254640329093349369689065873271770823099",
"315473104111186857374962334173265580333",
"80048884491124852650273286054430384196",
"294211044887595371300524002193312445607",
"133078914779736013338845934436926796440",
"146463953985568744589698557747633758335",
"195331429737106291294225146089996166671",
"13363434203171936748746681647503794471",
"283728498469261506240512251131484950353",
"280031938939983792312485984336032124945",
"65085351482730483689028554405311447646",
"196151137738298008734767670427245134957",
"294510017095241354583248904173718282",
"116584664205692095912791929848289765590",
"184882080671822447818151505546663964278",
"272739886971920122151742234807030787971",
"210633725028398701382166961676283464967",
"317143059198639140353664310877853131308",
"154170745400797324132815540850006086228",
"222753815739076605463829998592043993485",
"295826724390093298791224524751064883936",
"96516559027346974629361668729068626930",
"254645623015092365468294521319518936020",
"184049461531116170671988474244261321405",
"53232409205404062326591313199330012881",
"320410998547087341892888613870701747149",
"322986542397744635813803918228580493080",
"184049461531116170671988474244261321405",
"142584072093493845388495344877921850466",
"22740249724982814493421683900167184421",
"279473259356032972146583102240528972050",
"46153913715656947543604078579437428009",
"165892347874492132823708791410485242593",
"208611510358629114054716990556762213593",
"209494411843847590532020921203333630454",
"271202875103203706868041496288631508940",
"166381407058946578153023839411953263581",
"188569597832177938075719048668128063701",
"40975315829486749829725176611122691001",
"315344457575658098216643087473526655597",
"104664549367388196188496615571945151626",
"302643515245255741659560481902769537780",
"260040611160320749102297183435315711051",
"301106992340074434764709848448801302729",
"279961317342196035425554820446092901969",
"163454305730622909411828327964030966099",
"230754844182930751817600293133592122593",
"75763416721585624891841502007437304761",
"153915455683267602565025294852849601311",
"205841227333750780777874377626766175655",
"15400018991913390327855292821294478646",
"338344545778997903429981248067651557738",
"14642640012053443668274228509385730074",
"89430874706491971300223511941584606436",
"260740804659486630655817519735047361345",
"265646223749104620381395857865931256775",
"174430560709795845905603975393090723855",
"134310997842149691702107503259749752853",
"72601427617302532688189347712159575073",
"272219939183913824951210081877040893092",
"142793992524866932292939625801766716347",
"214543269218276614126047126559979009612",
"208344499878816953274924488428452240601",
"45052745713842345289087290694150125923",
"300865579671083380435502285322690909554",
"234710255865473389894137863152073271705",
"185908624811284286845475739099354440980",
"61892764038983991119490552154498627512",
"226160088934699013722716025317465159403",
"176211798485646718836313572814970013580",
"321145011498361355806139277886097594617",
"171967404576667787030012050217770224464",
"224885986203179274375647307365228932453",
"18317610676404397260344761223332448865",
"335502649202321508085238239480567207472",
"28197969604205160354161476926547090287",
"194980450699299418918397155213003686821",
"231566129481391793607537174087277547601",
"301610097998262470891609465723116817655",
"177662197751607835325190723554695188126",
"317121994975660944918106201239612673965",
"13923452767824119615534287787733861393",
"199763831260405197014188278223662111177"
],
"threshold": 0.9
},
"id": "CVE-2026-106580-f26bf210",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/768bdd0dbb9a9ad743b6a6e557126b788b325970",
"target": {
"file": "coders/cut.c"
}
}
]
"2026-10-16T08:47:03Z"