Cloudanix VulnDB

CVE-2026-116148

Low · 3.6

CVSS

3.6

EPSS

0.1%

Published

Oct 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in widely used image software lets attackers sneak extra commands into image files, which could let them interfere with systems if untrusted images are processed.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw allows unsanitized user-supplied drawing options to be written verbatim into generated MVG output, enabling injection of arbitrary MVG drawing commands.

Why it matters to the business

Organizations processing images with ImageMagick may experience unauthorized command execution or file manipulation when handling untrusted inputs, increasing risk of data exposure or system compromise shortly after public disclosure.

How an attack unfolds

An attacker supplies a crafted drawing option containing MVG commands to an application that invokes ImageMagick's MVG encoder; the option is embedded without neutralization into the output file, allowing the injected commands to execute or alter processing behavior.

How to fix it

Upgrade ImageMagick to 6.9.13-58 or newer for the 6.x branch and to 7.1.2-33 or newer for the 7.x branch; apply updates across all affected deployments.

How to confirm the fix worked

Verify installed ImageMagick versions meet or exceed 6.9.13-58 and 7.1.2-33; test processing of drawing options to confirm injected commands are no longer emitted in output.

Typical attack path

  1. Locate an application or workflow that accepts drawing options and invokes ImageMagick MVG encoding
  2. Craft input containing injected MVG drawing commands
  3. Submit the input to trigger MVG file generation
  4. Leverage the resulting file or side effects to achieve further impact

How to detect it

Review application and image-processing logs for anomalous drawing-option strings or generated MVG files containing unexpected command sequences; inspect output artifacts for signs of injection.

What your security team should do

  • Apply the specified ImageMagick upgrades immediately due to recent publication
  • Audit code paths that pass user-controlled drawing options to ImageMagick
  • Implement input validation or sandboxing around image processing routines
  • Monitor generated MVG files for unexpected command sequences

The record

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities