CVE-2026-105399: ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image processing.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Any deployment using an affected ImageMagick version that processes MVG images from untrusted sources is exposed. An unauthenticated attacker can provide a crafted MVG image over any application workflow that accepts and decodes such files.
What does successful exploitation do?
Successful exploitation causes the MVG decoder to perform a long-running operation, consuming excessive CPU resources and stalling image processing. The reported impact is availability only; no confidentiality or integrity impact is specified.
Which versions need to be remediated?
ImageMagick versions before 6.9.13-56 and 7.x versions before 7.1.2-31 are affected. Updating to 6.9.13-56 or later in the 6.x line, or 7.1.2-31 or later in the 7.x line, addresses the affected version ranges.