CVE-2026-56379: ImageMagick command injection in SVG decoder

CVE-2026-56379 · Severity: low · CVSS 3.1 · Published 2026-06-23

ImageMagick, a widely used software suite for displaying and converting images, contains a flaw in how it processes SVG files. An attacker can create a specially crafted image file that forces the software to execute unintended drawing commands during the rendering process. While currently rated with no direct impact on data confidentiality or system availability by the reporting source, such flaws typically pose risks to the integrity of image processing workflows.

Technologies: Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-OpenMP-x86 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q8-x86 (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2026-56379 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56379 being exploited in the wild.
How severe is CVE-2026-56379?
Low severity, with a CVSS score of 3.1, published 23 June 2026.
Which products and versions are affected?
Magick.NET-Q16-AnyCPU (NuGet) < 14.10.3, ECOSYSTEM:introduced=0,fixed=14.10.3; Magick.NET-Q16-arm64 (NuGet) < 14.10.3, ECOSYSTEM:introduced=0,fixed=14.10.3; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.10.3, ECOSYSTEM:introduced=0,fixed=14.10.3; Magick.NET-Q16-HDRI-arm64 (NuGet) < 14.10.3, ECOSYSTEM:introduced=0,fixed=14.10.3; and 15 more.
Is there a fix for CVE-2026-56379?
Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-OpenMP-x86 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.10.3 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56379 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56379?
Check whether you run Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.3
  • Magick.NET-Q16-arm64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-arm64 --version 14.10.3
  • Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.3
  • Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.3
  • Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.3
  • Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.3
  • Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.3
  • Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.3
  • Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.3
  • Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.3
  • Magick.NET-Q16-OpenMP-x86 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-OpenMP-x86 --version 14.10.3
  • Magick.NET-Q16-x64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-x64 --version 14.10.3
  • Magick.NET-Q16-x86 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q16-x86 --version 14.10.3
  • Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q8-AnyCPU --version 14.10.3
  • Magick.NET-Q8-arm64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q8-arm64 --version 14.10.3
  • Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.3
  • Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.3
  • Magick.NET-Q8-x64 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q8-x64 --version 14.10.3
  • Magick.NET-Q8-x86 (NuGet): upgrade to 14.10.3 or later
    dotnet add package Magick.NET-Q8-x86 --version 14.10.3

Technical details

A command injection vulnerability exists in the ImageMagick SVG decoder (coders/svg.c) due to improper encoding or escaping of output (CWE-116). By crafting a malicious SVG file, an attacker can inject arbitrary Magick Vector Graphics (MVG) commands that are executed when the library attempts to render the image. The vulnerability is reachable over the network without authentication or user interaction if the application processes user-supplied SVG files. Although the provided CVSS score is 0.0, the flaw allows for the execution of unintended internal drawing instructions. Patches are available in versions 7.1.2-15 and 6.9.13-40.

Affected products

  • ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40

Identifiers

  • CVE-2026-56379
  • GHSA-xpg8-7m6m-jf56

Timeline

  • 2026-02-23: advisory: GitHub Security Advisory GHSA-xpg8-7m6m-jf56 published
  • 2026-06-23: disclosed: CVE-2026-56379 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.