CVE-2026-56379: ImageMagick - Command Injection via SVG Decoder
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u13Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u11Fixed in 8:7.1.2.31+dfsg1-1 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-15 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-40
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56379?
The severity of CVE-2026-56379 is rated as low.
How do I fix CVE-2026-56379?
To fix CVE-2026-56379, upgrade ImageMagick to versions 7.1.2-15 or 6.9.13-40 or later.
What does CVE-2026-56379 affect?
CVE-2026-56379 affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.
What type of vulnerability is CVE-2026-56379?
CVE-2026-56379 is a command injection vulnerability in the SVG decoder of ImageMagick.
Can CVE-2026-56379 allow arbitrary code execution?
Yes, CVE-2026-56379 allows attackers to inject arbitrary Magick Vector Graphics commands that can execute during rendering.