CVE-2026-106573

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-07

Last updated on: 2026-10-21

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-21

Generated

2026-11-08

AI Q&A

2026-10-07

EPSS Evaluated

2026-11-07

NVD

CVE-2026-106573

EUVD

EUVD-2026-94392

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-56 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-31 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in ImageMagick involves a missing limit check in the MVG decoder. A crafted MVG image can cause an excessively long-running operation before versions 7.1.2-31 and 6.9.13-56.

Detection Guidance

Detecting this vulnerability requires checking the installed version of ImageMagick. Run the command 'convert --version' or 'magick --version' to see the version number. If the output shows a version prior to 7.1.2-31 or 6.9.13-56, the system is vulnerable.

Impact Analysis

The vulnerability may lead to denial-of-service conditions by consuming excessive system resources due to prolonged image processing operations.

Compliance Impact

This vulnerability primarily impacts system availability due to uncontrolled resource consumption, which could lead to denial-of-service conditions. While it does not directly expose or leak data, prolonged resource exhaustion may disrupt services handling sensitive data, potentially affecting compliance with availability requirements in GDPR and HIPAA. However, the vulnerability itself does not directly violate these standards unless it results in unauthorized access or prolonged downtime affecting data integrity or availability.

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-31 or later for ImageMagick 7, or to version 6.9.13-56 or later for ImageMagick 6. This can typically be done via package managers like 'apt', 'yum', or 'brew' depending on your system.

Hi! I’m here to help you understand CVE-2026-106573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...