CVE-2026-106573
Received Received - Intake

Denial of Service in ImageMagick via MVG Decoder

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-106573
EUVD
EUVD-2026-94392

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick < 6.9.13-56
ImageMagick ImageMagick >= 7.0.0, < 7.1.2-31

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ImageMagick involves a missing limit check in the MVG decoder. A crafted MVG image can cause an excessively long-running operation before versions 7.1.2-31 and 6.9.13-56.

Detection Guidance

Detecting this vulnerability requires checking the installed version of ImageMagick. Run the command 'convert --version' or 'magick --version' to see the version number. If the output shows a version prior to 7.1.2-31 or 6.9.13-56, the system is vulnerable.

Impact Analysis

The vulnerability may lead to denial-of-service conditions by consuming excessive system resources due to prolonged image processing operations.

Compliance Impact

This vulnerability primarily impacts system availability due to uncontrolled resource consumption, which could lead to denial-of-service conditions. While it does not directly expose or leak data, prolonged resource exhaustion may disrupt services handling sensitive data, potentially affecting compliance with availability requirements in GDPR and HIPAA. However, the vulnerability itself does not directly violate these standards unless it results in unauthorized access or prolonged downtime affecting data integrity or availability.

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-31 or later for ImageMagick 7, or to version 6.9.13-56 or later for ImageMagick 6. This can typically be done via package managers like 'apt', 'yum', or 'brew' depending on your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart