GHSA-56m6-8q75-f2rw#Magick.NET-Q16-arm64

Summary

ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219

Severity

medium

CVSS

4.7

CWE

CWE-59, CWE-367, CWE-863

Published

2026-07-24

Updated

2026-07-24

Advisory details

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

References

• https://github.com/advisories/GHSA-56m6-8q75-f2rw
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56m6-8q75-f2rw
• https://github.com/dlemstra/Magick.NET/releases/tag/14.15.0

Related advisories

• CVE-2026-77361 — medium · npm/obsidian-tc
• CVE-2026-102832 — medium · PyPI/jupyterlab
• GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v5 — critical · Go/github.com/labstack/echo/v5
• GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v4 — critical · Go/github.com/labstack/echo/v4
• CVE-2026-77366 — critical · npm/obsidian-tc
• CVE-2026-77459 — critical · Go/github.com/argoproj/argo-cd/v2
• CVE-2026-68582 — critical · Go/code.vikunja.io/api
• CVE-2026-105851 — critical · npm/payload

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity