CVE-2026-56379High· 8.1▾ TwilightImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector G…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.9%
0.9% → 1.6%
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
imagemagick < 6.9.13-40imagemagick >= 7.1.0-0, < 7.1.2-15Upgrade past the affected range:
imagemagick 7.1.2-15Affected packages:
Magick.NET-Q16-AnyCPU < 14.10.3Magick.NET-Q16-HDRI-AnyCPU < 14.10.3Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.10.3Magick.NET-Q16-HDRI-OpenMP-x64 < 14.10.3Magick.NET-Q16-HDRI-arm64 < 14.10.3Magick.NET-Q16-HDRI-x64 < 14.10.3Magick.NET-Q16-HDRI-x86 < 14.10.3Magick.NET-Q16-OpenMP-arm64 < 14.10.3Magick.NET-Q16-OpenMP-x64 < 14.10.3Magick.NET-Q16-OpenMP-x86 < 14.10.3Magick.NET-Q16-arm64 < 14.10.3Magick.NET-Q16-x64 < 14.10.3Magick.NET-Q16-x86 < 14.10.3Magick.NET-Q8-AnyCPU < 14.10.3Magick.NET-Q8-OpenMP-arm64 < 14.10.3Magick.NET-Q8-OpenMP-x64 < 14.10.3Magick.NET-Q8-arm64 < 14.10.3Magick.NET-Q8-x64 < 14.10.3Magick.NET-Q8-x86 < 14.10.3Patched in:
Magick.NET-Q16-AnyCPU 14.10.3Magick.NET-Q16-HDRI-AnyCPU 14.10.3Magick.NET-Q16-HDRI-OpenMP-arm64 14.10.3Magick.NET-Q16-HDRI-OpenMP-x64 14.10.3Magick.NET-Q16-HDRI-arm64 14.10.3Magick.NET-Q16-HDRI-x64 14.10.3Magick.NET-Q16-HDRI-x86 14.10.3Magick.NET-Q16-OpenMP-arm64 14.10.3Magick.NET-Q16-OpenMP-x64 14.10.3Magick.NET-Q16-OpenMP-x86 14.10.3Magick.NET-Q16-arm64 14.10.3Magick.NET-Q16-x64 14.10.3Magick.NET-Q16-x86 14.10.3Magick.NET-Q8-AnyCPU 14.10.3Magick.NET-Q8-OpenMP-arm64 14.10.3Magick.NET-Q8-OpenMP-x64 14.10.3Magick.NET-Q8-arm64 14.10.3Magick.NET-Q8-x64 14.10.3Magick.NET-Q8-x86 14.10.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56371Medium· 5.3ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each…
CVE-2026-116146Low· 3.7ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder
CVE-2026-116143Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders
CVE-2026-116142Low· 3.3ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box
CVE-2026-116144Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder
CVE-2026-116145Low· 3.9ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix