CVE-2026-106573: ImageMagick: Denial of service in MVG decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-31 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-56
Event History
Frequently Asked Questions
Which deployments are exposed?
ImageMagick versions earlier than 7.1.2-31 and 6.9.13-56 are affected when they process MVG images. The issue can be triggered remotely and requires no authentication or user interaction.
What is required to exploit this issue?
An attacker needs to supply a crafted MVG image to a vulnerable ImageMagick instance for decoding. Successful exploitation causes an excessively long-running operation, resulting in a denial of service.
What should be done to remediate the issue?
Upgrade to ImageMagick 7.1.2-31 or later, or ImageMagick 6.9.13-56 or later. These versions include the missing limit check in the MVG decoder.