CVE-2026-109275: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder

Q: What conditions are required for exploitation?

An attacker must be able to provide a crafted MVG file that the affected ImageMagick installation decodes. Exploitation also requires that decoding uses a PostScript renderer.

Q: Which deployments are exposed?

ImageMagick versions earlier than 6.9.13-57 and 7.x versions earlier than 7.1.2-32 are affected when their MVG decoding path uses a PostScript renderer. The provided information does not establish whether this renderer is enabled in a default configuration.

Q: What is the immediate mitigation if upgrading is not possible?

Avoid decoding untrusted MVG files through a PostScript renderer. This removes the crafted MVG input and rendering condition described for exploitation.

Published Oct 12, 2026

Updated

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-57, <7.1.2-32

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to provide a crafted MVG file that the affected ImageMagick installation decodes. Exploitation also requires that decoding uses a PostScript renderer.

Which deployments are exposed?

ImageMagick versions earlier than 6.9.13-57 and 7.x versions earlier than 7.1.2-32 are affected when their MVG decoding path uses a PostScript renderer. The provided information does not establish whether this renderer is enabled in a default configuration.

What is the immediate mitigation if upgrading is not possible?

Avoid decoding untrusted MVG files through a PostScript renderer. This removes the crafted MVG input and rendering condition described for exploitation.

CVE-2026-109275: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments are exposed?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments are exposed?

What is the immediate mitigation if upgrading is not possible?