Live › vulnerability › CVE-2026-116144
Go to dashboardImageMagick's MVG (Magick Vector Graphics) decoder recurses without limit, so a crafted MVG file can exhaust the stack. An attacker who gets a service to read such a file can crash the process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Services that hand user-supplied files to ImageMagick, especially ones that accept MVG input or let users choose the input format, are exposed. Systems that only process trusted images, or never call ImageMagick on untrusted files, can skip this.
No product ranges from the sources yet.
magick -version and compare the reported version with the fixed releases below..mvg files to ImageMagick).6.9.13-58 or later.7.1.2-33 or later..mvg and .svg inputs at the upload boundary if they are not needed.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116144")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.