ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
CVE-2026-56379
CVSS base score
8.1 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-116, CWE-78
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
imagemagick imagemagick
References
- github.com Third Party Advisory
- www.vulncheck.com Third Party Advisory
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- security.access.redhat.com