9.2
Critical
CVE-2026-56379 ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows…
Description
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ImageMagick 6.9 | earliest → < 6.9.13-40 | 6.9.13-40 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Versions not published | |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | Versions not published |
References
- GitHub Security Advisory (GHSA-xpg8-7m6m-jf56) github.com
- VulnCheck Advisory: ImageMagick - Command Injection via SVG Decoder www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of ImageMagick
The 276 CVEs of ImageMagick →
CVE-2026-123273
ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder
7.1
High
CVE-2026-119124
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause…
4.8
Medium
CVE-2026-119123
ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder
6.3
Medium
CVE-2026-116160
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate
4.8
Medium