CVE-2026-56379
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A command injection vulnerability in ImageMagick before versions 7.1.2-15 and 6.9.13-40 exists in the SVG decoder. Attackers can inject arbitrary MVG (Magick Vector Graphics) commands via a crafted SVG file.
Risk Assessment
The risk involves potential remote execution of arbitrary MVG commands, which could lead to system compromise or data exfiltration.
Recommendation
Immediately update ImageMagick to version 7.1.2-15 or later (for the 7.x branch) and 6.9.13-40 or later (for the 6.x branch).
Other vulnerabilities in ImageMagick
See all- CVE-2017-17880High
In ImageMagick 7.0.7-16 Q16 x86_64, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check.
- CVE-2017-17879High
In ImageMagick 7.0.7-16 Q16 x86_64, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.
- CVE-2017-16546High
The ReadWPGImage function in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which may lead to denial of service or other unspecified impacts via a malformed WPG file.
- CVE-2017-15281High
The ReadPSDImage function in coders/psd.c in ImageMagick 7.0.7-6 has a vulnerability that allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted file.
- CVE-2017-15033High
ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.
- CVE-2017-14739High
The AcquireResampleFilterThreadSet function in ImageMagick 7.0.7-4 mishandles failed memory allocation, which can lead to denial of service via NULL Pointer Dereference in DistortImage.
- CVE-2017-14682High
GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document.
- CVE-2017-14137High
The ReadWEBPImage function in coders/webp.c in ImageMagick 7.0.6-5 has an issue with excessive memory allocation that depends only on a length field in a header.
- CVE-2017-13146High
In ImageMagick before version 6.9.8-5 and 7.x before version 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
- CVE-2017-13143High
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
Original NVD description (English source)
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.