ImageMagick - Command Injection via SVG Decoder
Impact
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands. The impact is uncertain.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
RHSA-2026:32961: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)
Restrict ImageMagick processing capabilities via policy.xml, disabling the SVG coder and restricting delegates to prevent injection escalation to OS command execution. Enforce mandatory access control (SELinux/AppArmor) combined with seccomp syscall filtering to block execve. For systemd services, enable NoNewPrivileges, ProtectSystem=strict, ProtectHome=true, and PrivateDevices=true.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
ImageMagick · VulnCheck
ImageMagick
2 ranges
ImageMagick · VulnCheck
ImageMagick
Compare with this publisher’s ranges. This does not inspect your installation.
affected
7.0.0 → before 7.1.2-15
semver versions
unaffected
7.1.2-15
semver versions
Other versions: unaffected
ImageMagick · VulnCheck
ImageMagick
2 ranges
ImageMagick · VulnCheck
ImageMagick
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 6.9.13-40
semver versions
unaffected
6.9.13-40
semver versions
Other versions: unaffected
Red Hat · redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Support
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:6.9.10.68-17.el7_9 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:rhel_els:7Red Hat · redhat-SADP
Red Hat Enterprise Linux 6
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 6
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unknown
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:6Original source description
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-56379View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
VulnCheck · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*From (inclusive): 7.0.0
Before: 7.1.2-15
Vulnerable product
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*Before: 6.9.13-40
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2-15",
"versionStartIncluding": "7.0.0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.13-40"
}
]
}
]
}
]Contributing organizations · 3
Assigning organization
Additional data publisher
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.