ImageMagick: SVG-to-MVG Command Injection via coders/svg.c
An attacker can inject arbitrary MVG (Magick Vector Graphics) drawing commands in an SVG file that is read by the internal SVG decoder of ImageMagick. The injected MVG commands execute during rendering.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56379US | — | — | ||
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers ca… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2026:32961WEB
- https://access.redhat.com/security/cve/CVE-2026-56379WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2491700WEB
- https://github.com/ImageMagick/ImageMagickPACKAGE
- https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaaWEB
- https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aaWEB
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-56379ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan