{"id":"CVE-2026-116148","kind":"vulnerability","aliases":["CVE-2026-116148"],"related":[],"title":"ImageMagick: drawing options injected into MVG output files","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file.","summary":"ImageMagick's MVG encoder does not neutralize user-supplied drawing options before writing them into generated MVG files. An attacker who can supply drawing options can inject arbitrary MVG drawing commands into the output file.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imagemagick","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `magick -version` (or `convert -version`) and compare against `6.9.13-58` and `7.1.2-33`.\n- Check whether user input can reach ImageMagick drawing options that produce MVG output.","fix":"- Upgrade ImageMagick 6.x to `6.9.13-58` or later.\n- Upgrade ImageMagick 7.x to `7.1.2-33` or later.","status":"open","published_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:43:10+00:00","updated_at":"2026-10-25T14:43:10+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T14:43:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick 6.x to `6.9.13-58` or later.\n- Upgrade ImageMagick 7.x to `7.1.2-33` or later.","reach":"unknown","title":"ImageMagick: drawing options injected into MVG output files","impact":"medium","summary":"ImageMagick's MVG encoder does not neutralize user-supplied drawing options before writing them into generated MVG files. An attacker who can supply drawing options can inject arbitrary MVG drawing commands into the output file.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker injects arbitrary drawing commands into generated MVG files","analyst_note":"Check the NVD entry and ImageMagick advisories for the exact exploitable code path and whether default configurations expose drawing options.","how_to_check":"- Run `magick -version` (or `convert -version`) and compare against `6.9.13-58` and `7.1.2-33`.\n- Check whether user input can reach ImageMagick drawing options that produce MVG output.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Applications that pass user-controlled drawing options to ImageMagick and write MVG output. Systems that only process trusted images or never expose drawing options to users can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000596,"input_tokens":3349,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116148':11A,14A '-2026':10A,13A '-33':65C '-58':59C '6.9.13':58C '7':61C '7.1.2':64C 'arbitrari':48B,99C 'attack':40B,91C 'command':51B,102C 'contain':66C 'cve':9A,12A 'draw':2A,30B,44B,50B,82C,95C,101C 'encod':23B,73C 'file':8A,38B,55B,107C 'generat':36B,88C 'host':19B 'imagemagick':1A,15B,20B,56C 'inject':4A,47B,68C,98C 'mvg':6A,22B,37B,49B,72C,89C,100C,106C 'neutral':26B,78C 'option':3A,31B,45B,83C,96C 'output':7A,54B,90C 'packag':16B 'proper':77C 'result':105C 'self':18B 'self-host':17B 'specifi':81C 'suppli':29B,43B,94C 'user':28B,80C 'user-specifi':79C 'user-suppli':27B 'vulner':69C 'write':33B,85C 'x':62C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass user-controlled drawing options to ImageMagick and write MVG output. Systems that only process trusted images or never expose drawing options to users can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116148","severity":null,"published_at":"2026-10-25T14:16:52+00:00","modified_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}