ImageMagick Injection Vulnerability in MVG Encoder
CVE-2026-116148

4.8MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116148?

An injection vulnerability exists in the MVG encoder of ImageMagick, which fails to adequately neutralize user-defined drawing options. This weakness allows attackers to embed arbitrary MVG drawing commands into the generated files if they can supply these drawing options, potentially leading to unauthorized actions within applications using the affected versions of ImageMagick.

Affected Version(s)

ImageMagick 7.0.0-0 < 7.1.2-33

ImageMagick 0 < 6.9.13-58

ImageMagick 7.1.2-33

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/imagemagick-before-6...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bewithyash
.