CVE-2026-109275: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.34+dfsg1-1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to provide a crafted MVG file that the affected ImageMagick installation decodes. Exploitation also requires that decoding uses a PostScript renderer.
Which deployments are exposed?
ImageMagick versions earlier than 6.9.13-57 and 7.x versions earlier than 7.1.2-32 are affected when their MVG decoding path uses a PostScript renderer. The provided information does not establish whether this renderer is enabled in a default configuration.
What is the immediate mitigation if upgrading is not possible?
Avoid decoding untrusted MVG files through a PostScript renderer. This removes the crafted MVG input and rendering condition described for exploitation.