{"id":"CVE-2026-116144","kind":"vulnerability","aliases":["CVE-2026-116144"],"related":[],"title":"ImageMagick: crafted MVG file crashes the process through stack exhaustion","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service.","summary":"ImageMagick's MVG (Magick Vector Graphics) decoder recurses without limit, so a crafted MVG file can exhaust the stack. An attacker who gets a service to read such a file can crash the process, causing denial of service.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["mvg-not-processed","no-untrusted-input"],"how_to_check":"- Run `magick -version` and compare the reported version with the fixed releases below.\n- Check whether the service accepts MVG input (for example, uploads or conversions that pass `.mvg` files to ImageMagick).","fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later.\n- Upgrade ImageMagick 7 to `7.1.2-33` or later.\n- Until patched, reject or block `.mvg` and `.svg` inputs at the upload boundary if they are not needed.","status":"open","published_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:44:13+00:00","updated_at":"2026-10-25T14:44:13+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T14:44:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later.\n- Upgrade ImageMagick 7 to `7.1.2-33` or later.\n- Until patched, reject or block `.mvg` and `.svg` inputs at the upload boundary if they are not needed.","reach":"unknown","title":"ImageMagick: crafted MVG file crashes the process through stack exhaustion","impact":"low","summary":"ImageMagick's MVG (Magick Vector Graphics) decoder recurses without limit, so a crafted MVG file can exhaust the stack. An attacker who gets a service to read such a file can crash the process, causing denial of service.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker crashes the ImageMagick process via a crafted file.","analyst_note":"","how_to_check":"- Run `magick -version` and compare the reported version with the fixed releases below.\n- Check whether the service accepts MVG input (for example, uploads or conversions that pass `.mvg` files to ImageMagick).","needs_analyst":false,"not_affected_if":["no-untrusted-input","mvg-not-processed"],"who_is_affected":"Services that hand user-supplied files to ImageMagick, especially ones that accept MVG input or let users choose the input format, are exposed. Systems that only process trusted images, or never call ImageMagick on untrusted files, can skip this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":3343,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116144':13A,16A '-2026':12A,15A '-33':72C '-58':66C '6.9.13':65C '7':68C '7.1.2':71C 'argument':99C 'attack':45B,87C 'caus':59B,107C 'contain':73C 'craft':2A,37B,91C 'crash':5A,56B,104C 'cve':11A,14A 'decod':31B,79C 'denial':60B,109C 'exhaust':10A,41B,100C 'file':4A,39B,54B,93C 'get':47B 'graphic':30B 'host':24B 'imag':18B 'image-process':17B 'imagemagick':1A,20B,25B,63C 'lead':82C 'limit':34B 'magick':28B 'mvg':3A,27B,38B,78C,92C 'overflow':86C 'packag':21B 'process':7A,19B,58B,106C 'read':51B,96C 'recurs':32B,75C 'self':23B 'self-host':22B 'servic':49B,62B,111C 'specif':98C 'stack':9A,43B,85C,102C 'suppli':89C 'uncontrol':74C 'vector':29B 'without':33B 'x':69C","nicknames":[],"mitigations":[],"who_affected":"Services that hand user-supplied files to ImageMagick, especially ones that accept MVG input or let users choose the input format, are exposed. Systems that only process trusted images, or never call ImageMagick on untrusted files, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116144","severity":null,"published_at":"2026-10-25T14:16:52+00:00","modified_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}