Cloudanix VulnDB

CVE-2026-116144

Low · 3.3

CVSS

3.3

EPSS

0.1%

Published

Oct 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in image handling software lets attackers crash programs by feeding them specially made files, causing temporary outages until fixed.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uncontrolled recursion in the MVG decoder triggers stack overflow, exhausting available stack space and crashing the process.

Why it matters to the business

Attackers can disrupt image-processing services and applications by causing crashes, leading to downtime and potential loss of availability for dependent systems.

How an attack unfolds

An attacker crafts a malicious MVG file containing deeply nested or recursive structures, then supplies it to an application using vulnerable ImageMagick with arguments that trigger MVG decoding, resulting in stack exhaustion and denial of service.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or later for the 6.x branch, or 7.1.2-33 or later for the 7.x branch. Disable MVG support if unused, or apply input validation and resource limits on image processing workflows.

How to confirm the fix worked

Verify installed ImageMagick version meets or exceeds the fixed releases; test by attempting to process a known-recursive MVG sample under controlled conditions and confirm no crash occurs.

Typical attack path

  1. Identify a target application or service that processes MVG files via ImageMagick
  2. Craft a malicious MVG file designed to trigger uncontrolled recursion
  3. Deliver the file to the target (e.g., via upload, email attachment, or web request)
  4. Trigger processing of the file with arguments that invoke the MVG decoder
  5. Observe process crash and resulting denial of service

How to detect it

Search application and system logs for sudden crashes or segmentation faults during MVG file processing; inspect recent file uploads or processed images for unusual MVG content; correlate with availability alerts from image-dependent services.

What your security team should do

  • Prioritize upgrade of ImageMagick to fixed versions across all environments within 48 hours due to recent publication
  • Review and restrict MVG file processing in public-facing applications
  • Implement sandboxing or containerization for image-handling services
  • Monitor for process crashes during image decoding tasks

The record

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities