{
  "cveId": "CVE-2026-122006",
  "testDate": "2026-11-04T15:58:55.124Z",
  "scope": "ImageMagick policy component and normal PNG functionality; not Rails or MiniMagick runtime integration",
  "version": "Version: ImageMagick 7.1.2-18 Q16 x86_64 23822 https://imagemagick.org",
  "fixedSourceCommit": "3f290b759c8e2ffe7c257951b1255740751355e4",
  "fixedPolicySha256": "d28aeb38b20a802ba961a413d22bf6bb606584431761e3b333a8969fcc439fff",
  "baseline": "Same ImageMagick installation without vendor policy path; not a running vulnerable Rails application",
  "networkPolicy": "live deny-all readback verified before checks",
  "cases": [
    {
      "name": "vendor_policy_directory_loaded",
      "pass": true
    },
    {
      "name": "MSL_and_Ghostscript_denials_in_vendor_policy",
      "pass": true
    },
    {
      "name": "baseline_png_encode_identify",
      "pass": true,
      "actual": "PNG 3x2"
    },
    {
      "name": "baseline_png_resize",
      "pass": true,
      "actual": "PNG 1x1"
    },
    {
      "name": "vendor_policy_png_encode_identify",
      "pass": true,
      "actual": "PNG 3x2"
    },
    {
      "name": "vendor_policy_png_resize",
      "pass": true,
      "actual": "PNG 1x1"
    }
  ],
  "allPassed": true,
  "limitations": [
    "No full Rails application or MiniMagick invocation executed",
    "No exploit reproduction",
    "No PDF/PostScript or secret-rotation validation"
  ],
  "originalPublishedAt": "2026-11-04T14:12:17.584Z",
  "score": {
    "source": "MITRE CNA",
    "version": "3.1",
    "baseScore": 9.8
  },
  "fixedBranches": {
    "8.1": "8.1.4.1",
    "8.0": "8.0.5.2"
  },
  "sources": [
    "https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9",
    "https://github.com/rails/rails/releases/tag/v8.1.4.1",
    "https://github.com/rails/rails/releases/tag/v8.0.5.2",
    "https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy"
  ]
}