CVE-2026-56379: ImageMagick - Command Injection via SVG Decoder
Published Jun 23, 2026
·Updated
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Affected Software
3 affected components
ImageMagick ImageMagick<7.1.2-15, <6.9.13-40
ImageMagick ImageMagick<6.9.13-40
ImageMagick ImageMagick>=7.1.0-0<7.1.2-15
Event History
Jun 23, 2026
CVE Published
via MITRE·12:13 PM
Data Sourced
via MITRE·12:13 PM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·01:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-56379?
The severity of CVE-2026-56379 is rated as low.
2
How do I fix CVE-2026-56379?
To fix CVE-2026-56379, upgrade ImageMagick to versions 7.1.2-15 or 6.9.13-40 or later.
3
What does CVE-2026-56379 affect?
CVE-2026-56379 affects ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.
4
What type of vulnerability is CVE-2026-56379?
CVE-2026-56379 is a command injection vulnerability in the SVG decoder of ImageMagick.
5
Can CVE-2026-56379 allow arbitrary code execution?
Yes, CVE-2026-56379 allows attackers to inject arbitrary Magick Vector Graphics commands that can execute during rendering.