PT-2026-51514 · Imagemagick · Imagemagick

Phenggeler · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-56379

NVD

CVSS v3.1

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-56379

Affected Products

Imagemagick

References · 3

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56379 · Security Note
• https://vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder · Note