Vulnerability · Published Jun 23, 2026 · Assigned by VulnCheck
CVE-2026-56379ImageMagick - Command Injection via SVG Decoder
High 8.1
In plain English
A high-severity OS command injection in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.6%top 23.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | graphicsmagick | no fix listed | DEBIAN-CVE-2026-56379 |
| Debian:13 | graphicsmagick | no fix listed | DEBIAN-CVE-2026-56379 |
| Debian:14 | graphicsmagick | 1.4+really1.3.49-1 | DEBIAN-CVE-2026-56379 |
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u8 | DEBIAN-CVE-2026-56379 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u8 | DEBIAN-CVE-2026-56379 |
| Debian:14 | imagemagick | 8:7.1.2.15+dfsg1-1 | DEBIAN-CVE-2026-56379 |
| NuGet | magick.net-q16-anycpu | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-arm64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-hdri-anycpu | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-hdri-arm64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-hdri-openmp-arm64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-hdri-openmp-x64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-hdri-x64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-hdri-x86 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-openmp-arm64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-openmp-x64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-openmp-x86 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-x64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q16-x86 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q8-anycpu | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q8-arm64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q8-openmp-arm64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q8-openmp-x64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q8-x64 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| NuGet | magick.net-q8-x86 | 14.10.3 | GHSA-xpg8-7m6m-jf56 |
| Ubuntu:25.10 | imagemagick | no fix listed | UBUNTU-CVE-2026-56379 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | 7.0.0 – before 7.1.2-15 |
| ImageMagick | ImageMagick | 0 – before 6.9.13-40 |
Weakness: CWE-116, CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-xpg8-7m6m-jf56) vendor-advisory
- VulnCheck Advisory: ImageMagick - Command Injection via SVG Decoder third-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-56379 vdb-entry, x_refsource_REDHAT
- RHBZ#2491700 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:32961 vendor-advisory, x_refsource_REDHAT