CVE-2026-105405 in ImageMagick
Summary
by MITRE • 10/08/2026
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains an invalid memory free vulnerability in the MVG decoder. Attackers can supply a crafted MVG image for processing to trigger the invalid free and crash the application, causing a denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The identified vulnerability resides within the MultiVector Graphics (MVG) decoder component of ImageMagick, affecting versions prior to 6.9.13-56 in the legacy branch and version 7.1.2-31 in the current major release line. This flaw is classified as an invalid memory free operation, which corresponds directly to CWE-415 Double Free or CWE-416 Use After Free depending on the specific execution path triggered by the malformed input. The MVG decoder is responsible for parsing and rendering vector-based graphics defined in a text-like format that allows for complex geometric operations. When processing an image file crafted specifically to exploit this weakness, the application fails to correctly manage memory allocation and deallocation cycles during the decoding process.
The technical mechanism of the flaw involves improper handling of internal data structures associated with MVG objects. An attacker can construct a malicious MVG input that causes the decoder to attempt freeing a memory block that has already been released or is in an inconsistent state. This violation of memory safety principles leads directly to application instability. In most practical scenarios, this results in an immediate crash of the ImageMagick process or any host application utilizing it as a library for image processing. The primary operational impact is a denial of service condition where legitimate users are unable to access services that rely on dynamic image generation or conversion capabilities powered by vulnerable versions of the software.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1499 Endpoint Denial of Service, as it enables an attacker to disrupt the availability of computing resources through resource exhaustion via application crash. While the immediate effect is often limited to local denial of service in standalone applications, if ImageMagick is deployed within a web server environment or cloud function that processes untrusted user-uploaded images without adequate sandboxing, this vulnerability could potentially be leveraged for remote denial of service attacks against infrastructure services. The lack of robust input validation and memory state tracking in the MVG parser allows external actors to trigger these faults reliably by submitting specially crafted files rather than relying on complex exploitation chains typical of code execution vulnerabilities.
Mitigation strategies require immediate upgrading to patched versions that address this specific memory management error. Administrators should ensure all systems running ImageMagick are updated to version 6.9.13-56 or later for the legacy branch, and version 7.1.2-31 or later for the current branch. In environments where immediate patching is not feasible due to dependency constraints, implementing strict input validation at the network perimeter can help mitigate risk by filtering out malformed MVG files before they reach the vulnerable decoder. Additionally, deploying image processing tasks within isolated containers with limited resource permissions and automatic restart policies can reduce the blast radius of potential denial-of-service incidents caused by such memory corruption flaws. Regular auditing of third-party dependencies is essential to maintain a secure posture against similar vulnerabilities in widely used open-source libraries.