High severity · published Jun 23, 2026
CVE-2026-56379
ImageMagick - Command Injection via SVG Decoder
8.1
CVSS
1.6%
EPSS
No
On KEV
Description
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
ImageMagick · ImageMagick
before 7.1.2-15; before 6.9.13-40 · source: vendor, NVD
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56379
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56379
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56
Third Party Advisory
https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:32961
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-56379
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2491700
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json
More from ImageMagick
8.4
CVE-2016-3714
ImageMagick Improper Input Validation Vulnerability
5.5
CVE-2016-3715
ImageMagick Arbitrary File Deletion Vulnerability
5.5
CVE-2016-3718
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
9.8
CVE-2026-25986
ImageMagick has a heap buffer overflow in YUV 4:2:2 decoder
9.8
CVE-2026-25983
ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"