CVE-2026-56379

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

CVSS 4.0

9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-29)

CWEs

CWE-116, CWE-78

Published

2026-06-23

Modified

2026-10-29

Record from

the NVD, synced 2026-10-29

Affected

• imagemagick:imagemagick

References

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56
• https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder
• https://access.redhat.com/errata/RHSA-2026:32961
• https://access.redhat.com/security/cve/CVE-2026-56379
• https://bugzilla.redhat.com/show_bug.cgi?id=2491700

Check your stackJSON