CVE-2026-56379

Modified Modified - Updated After Analysis

Command Injection in ImageMagick SVG Decoder

Publication date: 2026-06-23

Last updated on: 2026-07-02

Assigner: VulnCheck

Description

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-23

Last Modified

2026-07-02

Generated

2026-07-14

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-12

NVD

CVE-2026-56379

EUVD

EUVD-2026-38441

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-40 (exc)
imagemagick	imagemagick	From 7.1.0-0 (inc) to 7.1.2-15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-56379 is a command injection vulnerability in ImageMagick's SVG decoder that allows attackers to inject arbitrary Magick Vector Graphics (MVG) drawing commands into SVG files.

When the vulnerable versions of ImageMagick process these malicious SVG files, the injected MVG commands execute during rendering.

This occurs due to improper encoding or escaping of output in the SVG decoder.

The vulnerability affects ImageMagick versions before 7.1.2-15 and 6.9.13-40.

Impact Analysis

Despite being a command injection vulnerability, CVE-2026-56379 has a CVSS base score of 0.0, indicating no impact on confidentiality, integrity, or availability.

The attack requires no privileges, user interaction, or network access.

Therefore, this vulnerability does not result in any direct harmful impact such as data breach, system compromise, or service disruption.

Detection Guidance

This vulnerability involves the injection of arbitrary MVG drawing commands into SVG files processed by ImageMagick versions prior to 7.1.2-15 and 6.9.13-40.

Detection can focus on identifying the presence of vulnerable ImageMagick versions on your system and scanning for suspicious or crafted SVG files that may contain injected MVG commands.

Specific commands to detect this vulnerability are not provided in the available resources.

Mitigation Strategies

The primary mitigation step is to update ImageMagick to a fixed version, specifically version 7.1.2-15 or later, or 6.9.13-40 or later.

Avoid processing untrusted or malicious SVG files with vulnerable versions of ImageMagick to prevent exploitation.

Compliance Impact

The vulnerability in ImageMagick (CVE-2026-56379) is a low-severity command injection that does not impact confidentiality, integrity, or availability.

Because it does not affect these core security properties, there is no direct indication from the provided information that this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-56379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70