CVE-2026-105824
Received Received - Intake

Use-After-Free in ImageMagick via SVG Decoding

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a use-after-free vulnerability in the RSVG decoder when built without cairo support, triggered when a limit is hit during decoding. Attackers can supply crafted SVG files that cause a limit to be reached, leading to access of freed memory and a crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-105824
EUVD
EUVD-2026-95011

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free flaw in ImageMagick's RSVG decoder when built without Cairo support. It occurs when a limit is reached during decoding of crafted SVG files, causing access to freed memory and potential crashes. Attackers can exploit this by supplying malicious SVG files to trigger denial-of-service conditions.

Detection Guidance

Check ImageMagick version with 'convert --version' or 'magick --version'. If using versions before 7.1.2-30 or 6.9.13-55 without Cairo support, the system is vulnerable. Monitor for crashes when processing SVG files.

Impact Analysis

This vulnerability can lead to denial-of-service attacks, causing applications using ImageMagick to crash. It may also allow attackers to execute arbitrary code or gain unauthorized access to system resources, depending on the context and system configuration.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing systems through crafted SVG files. It does not directly lead to data breaches or unauthorized access, which are key concerns for GDPR and HIPAA. However, repeated crashes could disrupt services handling sensitive data, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade ImageMagick to patched versions 7.1.2-30 or later and 6.9.13-55 or later. Ensure Cairo support is enabled during build. Avoid processing untrusted SVG files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart