DEBIAN-CVE-2026-116148: Low severity debian/imagemagick vulnerability

Q: Who is exposed to this issue?

Systems that use ImageMagick to generate MVG files and allow an attacker to supply drawing options are exposed. The issue affects ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33.

Q: What does an attacker need to exploit it?

An attacker needs the ability to provide drawing options that are incorporated into generated MVG output. Exploitation also requires user interaction, as indicated by the UI:R vector.

Q: What can an attacker do with a successful exploit?

The attacker can inject arbitrary MVG drawing commands into the generated MVG file. The provided vector indicates low confidentiality impact, with no integrity or availability impact.

Published Oct 25, 2026

Updated

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file.

Affected Software

3 affected componentsFixes available

debian/imagemagick*

debian/imagemagick<8:7.1.2.33+dfsg1-1

8:7.1.2.33+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:7.1.2.33+dfsg1-1

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems that use ImageMagick to generate MVG files and allow an attacker to supply drawing options are exposed. The issue affects ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33.

What does an attacker need to exploit it?

An attacker needs the ability to provide drawing options that are incorporated into generated MVG output. Exploitation also requires user interaction, as indicated by the UI:R vector.

What can an attacker do with a successful exploit?

The attacker can inject arbitrary MVG drawing commands into the generated MVG file. The provided vector indicates low confidentiality impact, with no integrity or availability impact.

DEBIAN-CVE-2026-116148: Low severity debian/imagemagick vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker do with a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker do with a successful exploit?