CVE-2026-56379CWE-116
ImageMagick - Command Injection via SVG Decoder
Critical · published June 23, 2026
What it is
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
The record
Technical detail
- CVSS v4.0
- 9.2 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.01643 · 76.2th percentile
- Weakness
- CWE-116 · Improper Encoding or Escaping of Output
- Published
- 2026-06-23T12:13Z
EPSS history
Timeline