CVE-2026-32259

unknown

EUVD alias: EUVD-2026-11692

Published 2026-08-10 · Modified —

Discuss on Community Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

—

Description

ImageMagick vulnerabilities

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

community-verified Authored 2026-05-29

{

Edit /etc/ImageMagick-7/policy.xml (or -6 for older branches) and add a denial rule for the SIXEL coder:

<policymap>
  <policy domain="coder" rights="none" pattern="SIXEL" />
</policymap>

Restart any application servers or workers using ImageMagick (e.g. systemctl restart apache2 or relevant container pods). Verify with:

convert -list format | grep -i sixel
# should show "SIXEL" with no read/write permissions

Rollback: Remove the policy line and restart services. SIXEL is a legacy DEC terminal format; disabling it has minimal impact on modern workflows.

Upgrade to 7.1.2-16+ or 6.9.13-41+ as soon as vendor packages are available.

}

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`8:7.1.1.43+dfsg1-1+deb13u7`
sid	Fixed	`8:7.1.2.16+dfsg1-1`
forky	Fixed	`8:7.1.2.16+dfsg1-1`
bullseye	Fixed	`8:6.9.11.60+dfsg-1.3+deb11u11`
bookworm	Fixed	`8:6.9.11.60+dfsg-1.6+deb12u8`

Ubuntu Fixed 6 releases

Version	Status	Fixed in
xenial	Fixed	`8:6.8.9.9-7ubuntu5.16+esm23`
trusty	Fixed	`8:6.7.7.10-6ubuntu3.13+esm24`
noble	Fixed	`8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm12`
jammy	Fixed	`8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm13`
focal	Fixed	`8:6.9.10.23+dfsg-2.1ubuntu11.11+esm13`
bionic	Fixed	`8:6.9.7.4+dfsg-16ubuntu6.15+esm15`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.