CVE-2026-56379 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command…

Description

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

Metadata

CVE ID: CVE-2026-56379
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-21 02:05 UTC
Published: 2026-06-23 12:13 UTC
Last updated: 2026-06-23 13:58 UTC
Primary CWE: CWE-116
Improper Encoding or Escaping of Output
Vendor / Product: ImageMagick / ImageMagick
Sources: cve.org · NVD

Severity & Metrics

0.0 N/D CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (2)

Vendor	Product	Platform	Versions
ImageMagick	ImageMagick	—	0 < 7.1.2-15, 7.1.2-15
ImageMagick	ImageMagick	—	0 < 6.9.13-40, 6.9.13-40

Weakness (CWE)

CWE	Source	Description
CWE-116	cna	Improper Encoding or Escaping of Output

CVSS scores (2)

Score	Severity	Version	Source	Vector
0.0	N/D	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
0.0	N/D	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

References (2)

GitHub Security Advisory (GHSA-xpg8-7m6m-jf56) https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56
VulnCheck Advisory: ImageMagick - Command Injection via SVG Decoder https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder