CVE-2026-24484: ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS
Published Feb 24, 2026
·Updated
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Affected Software
21 affected componentsFixes available
ImageMagick ImageMagick<7.1.2-15, <6.9.13-40
nuget/Magick.NET-Q8-x86<14.10.3
14.10.3
nuget/Magick.NET-Q8-arm64<14.10.3
14.10.3
nuget/Magick.NET-Q8-OpenMP-x64<14.10.3
14.10.3
nuget/Magick.NET-Q8-OpenMP-arm64<14.10.3
14.10.3
nuget/Magick.NET-Q8-AnyCPU<14.10.3
14.10.3
nuget/Magick.NET-Q16-x86<14.10.3
14.10.3
nuget/Magick.NET-Q16-arm64<14.10.3
14.10.3
nuget/Magick.NET-Q16-OpenMP-x86<14.10.3
14.10.3
nuget/Magick.NET-Q16-OpenMP-x64<14.10.3
14.10.3
nuget/Magick.NET-Q16-OpenMP-arm64<14.10.3
14.10.3
nuget/Magick.NET-Q16-HDRI-x86<14.10.3
14.10.3
nuget/Magick.NET-Q16-HDRI-x64<14.10.3
14.10.3
nuget/Magick.NET-Q16-HDRI-arm64<14.10.3
14.10.3
nuget/Magick.NET-Q16-HDRI-OpenMP-x64<14.10.3
14.10.3
nuget/Magick.NET-Q16-HDRI-OpenMP-arm64<14.10.3
14.10.3
nuget/Magick.NET-Q16-HDRI-AnyCPU<14.10.3
14.10.3
nuget/Magick.NET-Q16-AnyCPU<14.10.3
14.10.3
ImageMagick ImageMagick<6.9.13-40
ImageMagick ImageMagick>=7.0.0-0<7.1.2-15
Dlemstra Magick.net<14.10.3
Remediation
Event History
Feb 24, 2026
CVE Published
via MITRE·12:31 AM
Data Sourced
via MITRE·12:31 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·03:28 PM
Data Sourced
via GitHub·03:28 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-24484?
CVE-2026-24484 is classified as a Denial of Service (DoS) vulnerability.
2
How do I fix CVE-2026-24484?
To fix CVE-2026-24484, users need to upgrade to ImageMagick version 7.1.2-15 or 6.9.13-40 and above.
3
What causes the vulnerability CVE-2026-24484?
CVE-2026-24484 is caused by the failure of ImageMagick to properly check multi-layer nested MVG conversions to SVG.
4
Which versions of ImageMagick are affected by CVE-2026-24484?
Versions of ImageMagick prior to 7.1.2-15 and 6.9.13-40 are affected by CVE-2026-24484.
5
Can I use a specific package to address CVE-2026-24484?
Yes, you can use the Magick.NET package version 14.10.3 to address CVE-2026-24484.