CVE-2026-116148: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options

Q: Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they generate MVG output using user-supplied drawing options.

Q: What must an attacker be able to do to exploit it?

An attacker must be able to supply drawing options that are incorporated into generated MVG output. They can use those options to inject arbitrary MVG drawing commands into the resulting file.

Q: How can I tell whether my workflow is affected?

Review whether your application accepts drawing options from untrusted users and passes them to ImageMagick while producing MVG files. If so, affected ImageMagick versions may generate MVG output containing attacker-injected commands.

Q: What can be done before upgrading?

Do not allow untrusted users to provide drawing options used to generate MVG output. Restrict or sanitize those inputs so they cannot introduce arbitrary MVG drawing commands.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file.

Affected Software

1 affected component

ImageMagick ImageMagick<6.9.13-58, <7.1.2-33

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick versions earlier than 6.9.13-58 or 7.x versions earlier than 7.1.2-33 are affected when they generate MVG output using user-supplied drawing options.

What must an attacker be able to do to exploit it?

An attacker must be able to supply drawing options that are incorporated into generated MVG output. They can use those options to inject arbitrary MVG drawing commands into the resulting file.

How can I tell whether my workflow is affected?

Review whether your application accepts drawing options from untrusted users and passes them to ImageMagick while producing MVG files. If so, affected ImageMagick versions may generate MVG output containing attacker-injected commands.

What can be done before upgrading?

Do not allow untrusted users to provide drawing options used to generate MVG output. Restrict or sanitize those inputs so they cannot introduce arbitrary MVG drawing commands.

CVE-2026-116148: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

How can I tell whether my workflow is affected?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

How can I tell whether my workflow is affected?

What can be done before upgrading?