ImageMagick Policy Bypass Vulnerability via Delegate Invocation Parsing (CVE-2026-116140)
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 are vulnerable to a policy bypass via delegate invocation parsing. An attacker can exploit this vulnerability to execute blocked programs defined in policy.xml. The vulnerability has a CVSS score of 3.3, indicating a low severity level.