CRITICAL🇵🇱 Wersja polska

CVE-2026-56379

CVSS 9.2v4.0pub. 2026-06-23upd. 2026-07-02

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Imagemagick

    APP
    Imagemagick
    < 6.9.13-407.1.0-0 – 7.1.2-15 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2023-34152CRITICAL9.8PL ✓same product

RCE w ImageMagick poprzez command injection w funkcji OpenBlob

CVE-2019-19948CRITICAL9.8PL ✓same product

ImageMagick: heap-based buffer overflow w funkcji WriteSGIImage

CVE-2019-19949CRITICAL9.1PL ✓same product

ImageMagick: heap-based buffer over-read przy zapisie pliku PNG

CVE-2019-19952CRITICAL9.8PL ✓same product

ImageMagick: use-after-free w MngInfoDiscardObject (plik PNG/MNG)

CVE-2018-16329CRITICAL9.8PL ✓same product

NULL pointer dereference w ImageMagick — funkcja GetMagickProperty