PT-2026-23904 · Nuget · Magick.Net-Q16-Anycpu+18

Publicado 2026-02-25 · Atualizado 2026-02-25

OSV

CVSS v3.1

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

An attacker can inject arbitrary MVG (Magick Vector Graphics) drawing commands in an SVG file that is read by the internal SVG decoder of ImageMagick. The injected MVG commands execute during rendering.

Correção

Improper Encoding or Escaping of Output

Command Injection

Enumeração de Fraquezas

CWE-116

CWE-77

Identificadores relacionados

GHSA-XPG8-7M6M-JF56

Produtos afetados

Magick.Net-Q16-Anycpu

Magick.Net-Q16-Hdri-Anycpu

Magick.Net-Q16-Hdri-Openmp-Arm64

Magick.Net-Q16-Hdri-Openmp-X64

Magick.Net-Q16-Hdri-Arm64

Magick.Net-Q16-Hdri-X64

Magick.Net-Q16-Hdri-X86

Magick.Net-Q16-Openmp-Arm64

Magick.Net-Q16-Openmp-X64

Magick.Net-Q16-Openmp-X86

Magick.Net-Q16-Arm64

Magick.Net-Q16-X64

Magick.Net-Q16-X86

Magick.Net-Q8-Anycpu

Magick.Net-Q8-Openmp-Arm64

Magick.Net-Q8-Openmp-X64

Magick.Net-Q8-Arm64

Magick.Net-Q8-X64

Magick.Net-Q8-X86

Referências · 5

• https://github.com/ImageMagick/ImageMagick · Nota
• https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa · Nota
• https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa · Nota
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56 · Nota
• https://osv.dev/vulnerability/GHSA-xpg8-7m6m-jf56 · Aviso do Fabricante