Live › vulnerability › CVE-2026-116148
Go to dashboardImageMagick's MVG encoder does not neutralize user-supplied drawing options before writing them into generated MVG files. An attacker who can supply drawing options can inject arbitrary MVG drawing commands into the output file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Applications that pass user-controlled drawing options to ImageMagick and write MVG output. Systems that only process trusted images or never expose drawing options to users can likely skip it.
No product ranges from the sources yet.
magick -version (or convert -version) and compare against 6.9.13-58 and 7.1.2-33.6.9.13-58 or later.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file.
This page as .md · .json · in your agent: get_signal("CVE-2026-116148")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.