by Kastro
Paper/Archive/CVE-2026-56379

CVE-2026-56379

ImageMagick ImageMagick — ImageMagick - Command Injection via SVG Decoder

EPSS 2%CVSS 9.2
critical.is priorityof 100
43
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 76.4.764 × 2015.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

Affected

ProductAffectedFixed inSource
ImageMagick7.0.0 – < 7.1.2-157.1.2-15CNA
ImageMagick< 6.9.13-406.9.13-40CNA
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:6.9.10.68-17.el7_9redhat-SADP
Red Hat Enterprise Linux 6see advisory–redhat-SADP

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
redhat-SADP (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorygithub.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56writeupvulncheck.com/advisories/imagemagick-command-injection-via-svg-decoderrefaccess.redhat.com/security/cve/CVE-2026-56379refbugzilla.redhat.com/show_bug.cgi?id=2491700refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.jsonadvisoryaccess.redhat.com/errata/RHSA-2026:32961