RCE in Imagemagick
CVE-2026-56379
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
EPSS: 0.009 (57.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Imagemagick — versions 0, 7.1.2-15, 6.9.13-40
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory, Third Party Advisory)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-56379?
- CVE-2026-56379 is a high-severity vulnerability in Imagemagick, classified under Improper Encoding or Escaping of Output. CVSS score: 8.1/10. Published 2026-06-23.
- How severe is CVE-2026-56379?
- High severity. CVSS v3 base score is 8.1 out of 10.