Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-24484 EUVD-2026-7459GHSA-wg3g-gvx5-2pmv

ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

Published Feb 24, 2026 · Updated Feb 26, 2026 · Assigned by GitHub_M

Vendor: ImageMagick Product: ImageMagick Package: imagemagick Package: imagemagick Package: imagemagick Package: magick.net-q16-anycpu Package: Magick.NET-Q16-arm64 Package: magick.net-q16-hdri-anycpu Package: Magick.NET-Q16-HDRI-arm64 Package: Magick.NET-Q16-HDRI-OpenMP-arm64 Package: Magick.NET-Q16-HDRI-OpenMP-x64 Package: Magick.NET-Q16-HDRI-x64 Package: Magick.NET-Q16-HDRI-x86 Package: Magick.NET-Q16-OpenMP-arm64 Package: Magick.NET-Q16-OpenMP-x64 Package: Magick.NET-Q16-OpenMP-x86 Package: magick.net-q16-x64 Package: Magick.NET-Q16-x86 Package: magick.net-q8-anycpu Package: Magick.NET-Q8-arm64 Package: Magick.NET-Q8-OpenMP-arm64 Package: magick.net-q8-openmp-x64 Package: magick.net-q8-x64 Package: Magick.NET-Q8-x86 Ecosystem: Alpine Ecosystem: Debian Ecosystem: NuGet Ecosystem: Ubuntu

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Affected products

VendorProductAffectedFixed
ImageMagick ImageMagick >= 7.0.0, < 7.1.2-15, < 6.9.13-40 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 imagemagick 8:7.1.2.15+dfsg1-1 —
Debian 13 imagemagick 8:7.1.1.43+dfsg1-1+deb13u6 DSA-6158-1
Debian 12 imagemagick 8:6.9.11.60+dfsg-1.6+deb12u7 DSA-6159-1
Debian 11 imagemagick 8:6.9.11.60+dfsg-1.3+deb11u10 DLA-4497-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 imagemagick 8:7.1.2.3+dfsg1-1ubuntu0.1 USN-8263-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS imagemagick 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9 USN-8263-1
Ubuntu Pro 22.04 LTS imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10 USN-8263-1
Ubuntu Pro 20.04 LTS imagemagick 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10 USN-8263-1
Ubuntu Pro 18.04 LTS imagemagick 8:6.9.7.4+dfsg-16ubuntu6.15+esm12 USN-8263-1
Ubuntu Pro 16.04 LTS imagemagick 8:6.8.9.9-7ubuntu5.16+esm20 USN-8263-1
Ubuntu Pro 14.04 LTS imagemagick 8:6.7.7.10-6ubuntu3.13+esm21 USN-8263-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:1202-1, SUSE-SU-2026:0853-1
SLES 15 SP6 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:0853-1, SUSE-SU-2026:0852-1
SLES 15 SP5 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:0853-1
SLES 15 SP4 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:0853-1
SLES 12 SP5 ImageMagick 6.8.8.1-71.231.1 SUSE-SU-2026:1201-1, SUSE-SU-2026:0854-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 ImageMagick 7.1.2.0-160000.7.1 SUSE-SU-2026:20917-1
SLES for SAP 15 SP6 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:0853-1, SUSE-SU-2026:0852-1
SLES for SAP 15 SP5 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:0853-1
SLES for SAP 15 SP4 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:0853-1
SLES 16.0 ImageMagick 7.1.2.0-160000.7.1 SUSE-SU-2026:20917-1
SLE HPC 15 SP5 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:0853-1
SLE HPC 15 SP4 ImageMagick 7.1.0.9-150400.6.68.2 SUSE-SU-2026:1497-1, SUSE-SU-2026:0853-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ImageMagick 7.1.2.15-2.1 openSUSE-SU-2026:10278-1
openSUSE Leap 16.0 ImageMagick 7.1.2.0-160000.6.1 openSUSE-SU-2026:20405-1, openSUSE-SU-2026:20337-1
openSUSE Leap 15.6 ImageMagick 7.1.1.21-150600.3.42.2 SUSE-SU-2026:0870-1, SUSE-SU-2026:0852-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 imagemagick 7.1.2.15-r0 —
Alpine v3.23 imagemagick 7.1.2.15-r0 —
Alpine v3.22 imagemagick 7.1.2.15-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 ImageMagick +6 1:6.9.13.40-1.amzn2023.0.1 ALAS2023-2026-1478
Amazon Linux 2 ImageMagick +5 6.9.10.97-1.amzn2.0.22 ALAS2-2026-3211

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Magick.NET-Q16-AnyCPU < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-arm64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-HDRI-AnyCPU < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-HDRI-arm64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-HDRI-OpenMP-x64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-HDRI-x64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-HDRI-x86 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-OpenMP-arm64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-OpenMP-x64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-OpenMP-x86 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-x64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q16-x86 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q8-AnyCPU < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q8-arm64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q8-OpenMP-arm64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q8-OpenMP-x64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q8-x64 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv
NuGet Magick.NET-Q8-x86 < 14.10.3 14.10.3 GHSA-wg3g-gvx5-2pmv

Advisories 20

References