PT-2026-23904 · Nuget · Magick.Net-Q16-Anycpu+18

Published 2026-02-25 · Updated 2026-02-25

OSV

CVSS v3.1

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

An attacker can inject arbitrary MVG (Magick Vector Graphics) drawing commands in an SVG file that is read by the internal SVG decoder of ImageMagick. The injected MVG commands execute during rendering.

Fix

Improper Encoding or Escaping of Output

Command Injection

Weakness Enumeration

CWE-116

CWE-77

Related Identifiers

GHSA-XPG8-7M6M-JF56

Affected Products

Magick.Net-Q16-Anycpu

Magick.Net-Q16-Hdri-Anycpu

Magick.Net-Q16-Hdri-Openmp-Arm64

Magick.Net-Q16-Hdri-Openmp-X64

Magick.Net-Q16-Hdri-Arm64

Magick.Net-Q16-Hdri-X64

Magick.Net-Q16-Hdri-X86

Magick.Net-Q16-Openmp-Arm64

Magick.Net-Q16-Openmp-X64

Magick.Net-Q16-Openmp-X86

Magick.Net-Q16-Arm64

Magick.Net-Q16-X64

Magick.Net-Q16-X86

Magick.Net-Q8-Anycpu

Magick.Net-Q8-Openmp-Arm64

Magick.Net-Q8-Openmp-X64

Magick.Net-Q8-Arm64

Magick.Net-Q8-X64

Magick.Net-Q8-X86

References · 5

• https://osv.dev/vulnerability/GHSA-xpg8-7m6m-jf56 · Vendor Advisory
• https://github.com/ImageMagick/ImageMagick · Note
• https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa · Note
• https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa · Note
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56 · Note