UBUNTU-CVE-2026-116148: Medium severity ubuntu/imagemagick vulnerability
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using ImageMagick to generate MVG files are exposed if an attacker can supply drawing options that are included in the generated output. The issue affects ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33.
What does an attacker need to exploit it?
The attacker needs the ability to provide drawing options to a workflow that writes MVG output. Exploitation also requires a user or other consumer to interact with the generated MVG file, as indicated by the user-interaction requirement.
How can I determine whether my deployment is affected?
Check the installed ImageMagick version and whether the application generates MVG output using user-controlled drawing options. Versions earlier than 6.9.13-58, or 7.x versions earlier than 7.1.2-33, are affected.
What can be done while patching is not immediately possible?
Do not allow untrusted users to supply drawing options that are written into MVG files. Restrict or disable generation of MVG output from user-controlled input until an updated ImageMagick version can be deployed.