Skip to content
OpenAdvisories
High · 8.1 CVE-2026-56379 EUVD-2026-38441GHSA-v772-658q-978pGHSA-xpg8-7m6m-jf56

ImageMagick - Command Injection via SVG Decoder

Published Jun 23, 2026 · Updated Oct 29, 2026 · Assigned by VulnCheck

Vendor: ImageMagick Product: ImageMagick Package: graphicsmagick Package: imagemagick Package: imagemagick Package: magick.net-q16-anycpu Package: Magick.NET-Q16-arm64 Package: magick.net-q16-hdri-anycpu Package: Magick.NET-Q16-HDRI-arm64 Package: Magick.NET-Q16-HDRI-OpenMP-arm64 Package: Magick.NET-Q16-HDRI-OpenMP-x64 Package: Magick.NET-Q16-HDRI-x64 Package: Magick.NET-Q16-HDRI-x86 Package: Magick.NET-Q16-OpenMP-arm64 Package: Magick.NET-Q16-OpenMP-x64 Package: Magick.NET-Q16-OpenMP-x86 Package: magick.net-q16-x64 Package: Magick.NET-Q16-x86 Package: magick.net-q8-anycpu Package: Magick.NET-Q8-arm64 Package: Magick.NET-Q8-OpenMP-arm64 Package: magick.net-q8-openmp-x64 Package: magick.net-q8-x64 Package: Magick.NET-Q8-x86 Ecosystem: Debian Ecosystem: NuGet Ecosystem: Ubuntu

Description

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

Affected products

VendorProductAffectedFixed
ImageMagick ImageMagick 7.0.0 – < 7.1.2-15, < 6.9.13-40 7.1.2-15

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 graphicsmagick 1.4+really1.3.49-1 —
Debian 14 imagemagick 8:7.1.2.15+dfsg1-1 —
Debian 13 graphicsmagick No fix yet —
Debian 13 imagemagick 8:7.1.1.43+dfsg1-1+deb13u8 —
Debian 12 graphicsmagick No fix yet —
Debian 12 imagemagick 8:6.9.11.60+dfsg-1.6+deb12u8 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 imagemagick No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS imagemagick 8:7.1.2.18+dfsg1-1ubuntu0.1~esm2 USN-8739-1
Ubuntu Pro 24.04 LTS imagemagick 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm13 USN-8739-2
Ubuntu Pro 22.04 LTS imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm14 USN-8739-1
Ubuntu Pro 20.04 LTS imagemagick 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm14 USN-8739-1
Ubuntu Pro 18.04 LTS imagemagick 8:6.9.7.4+dfsg-16ubuntu6.15+esm16 USN-8739-1
Ubuntu Pro 16.04 LTS imagemagick 8:6.8.9.9-7ubuntu5.16+esm24 USN-8739-1
Ubuntu Pro 14.04 LTS imagemagick 8:6.7.7.10-6ubuntu3.13+esm25 USN-8739-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 ELS ImageMagick +5 6.9.10.68-17.el7_9 RHSA-2026:32961

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 GraphicsMagick 1.3.42-150600.3.42.1 SUSE-SU-2026:3441-1
SLES 15 SP7 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3336-1, SUSE-SU-2026:3335-1, SUSE-SU-2026:3053-1
SLES 15 SP6 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3335-1, SUSE-SU-2026:3219-1, SUSE-SU-2026:3053-1
SLES 15 SP5 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3335-1, SUSE-SU-2026:3053-1
SLES 15 SP4 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3335-1, SUSE-SU-2026:3053-1
SLES 12 SP5 ImageMagick 6.8.8.1-71.259.1 SUSE-SU-2026:3298-1, SUSE-SU-2026:3024-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 ImageMagick 7.1.2.0-160000.11.1 SUSE-SU-2026:22861-1, SUSE-SU-2026:22620-1
SLES for SAP 15 SP6 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3335-1, SUSE-SU-2026:3219-1, SUSE-SU-2026:3053-1
SLES for SAP 15 SP5 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3335-1, SUSE-SU-2026:3053-1
SLES for SAP 15 SP4 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3335-1, SUSE-SU-2026:3053-1
SLES 16.0 ImageMagick 7.1.2.0-160000.11.1 SUSE-SU-2026:22861-1, SUSE-SU-2026:22620-1
SLE HPC 15 SP5 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3335-1, SUSE-SU-2026:3053-1
SLE HPC 15 SP4 ImageMagick 7.1.0.9-150400.6.96.1 SUSE-SU-2026:3335-1, SUSE-SU-2026:3053-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed GraphicsMagick 1.3.48-1.1 openSUSE-SU-2026:11414-1
openSUSE Tumbleweed ImageMagick 7.1.2.25-3.1 openSUSE-SU-2026:11127-1
openSUSE Leap 16.0 GraphicsMagick 1.3.45-160000.12.1 openSUSE-SU-2026:21553-1
openSUSE Leap 16.0 ImageMagick 7.1.2.0-160000.11.1 openSUSE-SU-2026:21426-1, openSUSE-SU-2026:21291-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 ImageMagick +6 1:6.9.13.50-1.amzn2023.0.2 ALAS2023-2026-1914
Amazon Linux 2 ImageMagick +5 6.9.10.97-1.amzn2.0.31 ALAS2-2026-3786

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Magick.NET-Q16-AnyCPU < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-arm64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-HDRI-AnyCPU < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-HDRI-arm64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-HDRI-OpenMP-x64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-HDRI-x64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-HDRI-x86 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-OpenMP-arm64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-OpenMP-x64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-OpenMP-x86 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-x64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q16-x86 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q8-AnyCPU < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q8-arm64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q8-OpenMP-arm64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q8-OpenMP-x64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q8-x64 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56
NuGet Magick.NET-Q8-x86 < 14.10.3 14.10.3 GHSA-xpg8-7m6m-jf56

Advisories 22

References