Executive brief
ImageMagick, a widely used software suite for displaying and converting images, contains a flaw in how it processes SVG files. An attacker can create a specially crafted image file that forces the software to execute unintended drawing commands during the rendering process. While currently rated with no direct impact on data confidentiality or system availability by the reporting source, such flaws typically pose risks to the integrity of image processing workflows.
Technical details
A command injection vulnerability exists in the ImageMagick SVG decoder (coders/svg.c) due to improper encoding or escaping of output (CWE-116). By crafting a malicious SVG file, an attacker can inject arbitrary Magick Vector Graphics (MVG) commands that are executed when the library attempts to render the image. The vulnerability is reachable over the network without authentication or user interaction if the application processes user-supplied SVG files. Although the provided CVSS score is 0.0, the flaw allows for the execution of unintended internal drawing instructions. Patches are available in versions 7.1.2-15 and 6.9.13-40.
Affected products
- ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40
Timeline
- 2026-02-23: advisory: GitHub Security Advisory GHSA-xpg8-7m6m-jf56 published
- 2026-06-23: disclosed: CVE-2026-56379 published to NVD