CVE-2026-55594

What it actually does

ImageMagick versions before 6.9.13-51 and 7.1.2-26 do not sufficiently enforce parsing depth limits in the MVG image decoder. A specially crafted MVG file, or an image routed to the MVG decoder, can cause uncontrolled stack growth and a stack overflow during image parsing. The expected impact is a crash of the ImageMagick process or the application worker invoking it, resulting primarily in denial of service rather than data disclosure or code execution based on the currently described behavior.

Why it matters to the business

Services that accept, transform, thumbnail, scan, or validate user-supplied images may be disrupted if an attacker submits a malicious file that causes ImageMagick to crash. The risk is most important for public upload portals, media-processing pipelines, content management systems, ticketing systems, messaging platforms, and APIs that automatically process images. Although the CVSS and EPSS values indicate moderate severity and low observed exploitation likelihood, ImageMagick is widely embedded in downstream products and automation workflows, so outages can appear in business applications that do not obviously expose ImageMagick directly.

How an attack unfolds

An attacker identifies an application or service that accepts image uploads or fetches remote images and processes them with a vulnerable ImageMagick release. The attacker prepares a crafted MVG payload designed to trigger excessive decoder recursion or nested parsing depth. The payload may be uploaded directly with an MVG extension, disguised with another extension if the application performs content-based decoding, or delivered through a workflow that invokes ImageMagick commands such as magick, convert, or identify. When the vulnerable decoder parses the file, the missing depth check allows stack exhaustion, causing the ImageMagick process or calling worker to terminate. Repeated submissions can cause recurring job failures, worker crashes, queue backlogs, degraded image-processing functionality, or partial service unavailability.

How to fix it

Upgrade ImageMagick to a fixed release: 6.9.13-51 or later for the 6.x branch, or 7.1.2-26 or later for the 7.x branch. Ensure operating-system packages, container images, language bindings, application bundles, and statically packaged vendor copies are all updated, because ImageMagick is often present as an indirect dependency. If immediate upgrade is not possible, disable MVG decoding where not required using ImageMagick policy controls, restrict accepted input formats to a small allowlist, reject MVG/SVG-like vector content if not business-critical, run image processing in a sandboxed low-privilege worker, enforce CPU/memory/process limits, and isolate upload-processing queues from user-facing application workers. Avoid relying only on file extensions or MIME headers; validate content and decoder routing as part of input handling.

How to confirm the fix worked

Confirm the installed ImageMagick version with commands such as `magick -version`, `convert -version`, package-manager queries, container image inventories, and software composition analysis. Validate that every runtime image-processing path uses ImageMagick 6.9.13-51 or later, or 7.1.2-26 or later. If MVG support is not required, confirm policy configuration denies MVG decoding and test that MVG input is rejected safely rather than parsed. Review application upload and conversion tests to ensure malformed image inputs fail gracefully without crashing workers. In containerized or bundled deployments, rebuild and redeploy images after package updates rather than only patching base hosts.

Typical attack path

1. Find an externally reachable application feature that accepts images, documents containing images, avatars, thumbnails, attachments, or remote image URLs.
2. Confirm or infer that uploaded content is processed by ImageMagick, commonly through error messages, metadata handling, thumbnail behavior, or application fingerprints.
3. Create a malformed MVG image containing deeply nested or otherwise crafted vector-graphics content intended to exhaust the parser stack.
4. Submit the file directly or disguise it in a format-handling path that still reaches the MVG decoder.
5. Trigger automatic processing, preview generation, metadata extraction, validation, or conversion.
6. Cause the ImageMagick process or dependent application worker to crash, producing failed jobs, HTTP errors, queue retries, or service degradation.
7. Repeat submissions as needed to sustain denial of service until vulnerable instances are upgraded or mitigations block the payload path.

How to detect it

To determine whether exploitation already occurred, review application upload logs, web access logs, API gateway logs, object-storage access logs, image-processing job logs, worker supervisor logs, container logs, system journals, crash reports, and core-dump records. Look for unexplained crashes of ImageMagick utilities or application workers shortly after image uploads, especially requests involving MVG files, unusual vector-graphics content, suspicious extensions, or content-type mismatches. Correlate HTTP 500 responses, failed thumbnail generation, queue retries, worker restarts, segmentation faults, stack-overflow messages, and coredumps involving `magick`, `convert`, or `identify`. Search recent uploaded files and quarantined samples for MVG syntax such as `push graphic-context`, `pop graphic-context`, and `viewbox`, particularly when repeated deeply or found in files with non-MVG extensions. Because public exploit maturity is not currently reported and no KEV listing exists, absence of a known exploit signature should not be treated as proof of non-exploitation; prioritize behavioral evidence of crashes and malformed image submissions.

• Segmentation fault
• stack overflow
• core dumped
• magick:
• convert:
• identify:
• MVG
• mvg:
• push graphic-context
• pop graphic-context
• viewbox
• image/x-mvg
• .mvg
• /usr/bin/magick
• /usr/bin/convert
• /usr/bin/identify
• /var/lib/systemd/coredump
• systemd-coredump
• ImageMagick
• MagickCore
• MagickWand

What your security team should do

• Inventory all applications, containers, CI/CD jobs, and background workers that invoke ImageMagick or compatible wrappers for image conversion, thumbnailing, preview generation, or metadata extraction.
• Prioritize patching public-facing upload and image-processing services to ImageMagick 6.9.13-51 or 7.1.2-26 or later.
• If patching is delayed, disable MVG decoding and restrict image processing to required formats using ImageMagick policy controls and application-layer allowlists.
• Run ImageMagick in isolated, resource-limited, non-privileged workers so parser crashes cannot take down critical application processes.
• Add monitoring for repeated ImageMagick crashes, segmentation faults, failed conversion jobs, and spikes in image-processing errors.
• Review recent upload, web, worker, and system logs for signs of malformed MVG processing or unexplained crashes around image-handling endpoints.
• Update dependency and container scanning policies to flag ImageMagick versions older than 6.9.13-51 and 7.1.2-26.