CVE-2026-56379
ImageMagick - Command Injection via SVG Decoder
- State
- Published
- Severity
- 9.2 Critical
- Published
- Jun 23, 2026
- Updated
- Oct 29, 2026
- Reserved
- Jun 21, 2026
Description
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | redhat-SADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ImageMagickImageMagick |
|
ImageMagickImageMagick |
|
References
- GitHub Security Advisory (GHSA-xpg8-7m6m-jf56)vendor-advisory
- VulnCheck Advisory: ImageMagick - Command Injection via SVG Decoderthird-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-56379vdb-entry
- RHBZ#2491700issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json
- https://access.redhat.com/errata/RHSA-2026:32961vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.