CVE-2026-116148 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The identified security flaw resides within the Meta Vector Graphics (MVG) encoder component of ImageMagick, affecting versions prior to 6.9.13-58 and version 7.x prior to 7.1.2-33. This vulnerability is classified as an injection weakness where the software fails to adequately sanitize or neutralize user-supplied input before processing it for output generation. Specifically, when ImageMagick processes images using MVG format specifications, it accepts drawing options that define visual elements such as shapes, colors, and text. The core technical deficiency lies in the lack of proper validation on these drawing parameters, allowing malicious actors to embed arbitrary commands directly into the generated MVG file rather than having them treated strictly as data or style attributes.
From a technical perspective, this flaw enables an attacker who has the ability to supply specific drawing options during image processing operations to inject unintended MVG directives. Because MVG is a vector graphics format that supports complex rendering instructions, including script execution capabilities in certain contexts or downstream parsers, injected commands can alter the structural integrity of the output file. This injection mechanism bypasses standard security boundaries by exploiting the parser's trust in input data, effectively turning a benign image processing task into a vehicle for code injection. The vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-74, which describes Improper Neutralization of Special Elements used in an XML Document, and more broadly CWE-94, Code Injection, depending on how the resulting MVG file is subsequently processed by other applications or services that consume vector graphics.
The operational impact of this vulnerability extends beyond simple data corruption. If a downstream application processes the compromised MVG files without additional sanitization, it may execute the injected commands. This could lead to unauthorized actions such as arbitrary code execution on systems where vulnerable parsers are deployed with elevated privileges. Furthermore, attackers might leverage this injection to perform cross-site scripting if the MVG output is rendered in web contexts, or to facilitate denial of service attacks by generating malformed files that crash parsing engines. The risk is particularly acute in environments where ImageMagick is used as part of a larger pipeline involving untrusted user uploads, such as content management systems, photo hosting services, or automated document conversion tools.
Mitigation strategies primarily involve upgrading the ImageMagick installation to version 6.9.13-58 or later for the legacy branch, and version 7.1.2-33 or later for the current major release line, as these versions include patches that enforce stricter input validation within the MVG encoder. In scenarios where immediate patching is not feasible, administrators should implement strict allow-lists for any user-supplied drawing parameters passed to ImageMagick commands. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking suspicious patterns in image metadata or processing requests can provide an additional layer of defense. It is also critical to ensure that downstream applications consuming MVG outputs perform their own independent validation checks rather than relying solely on the integrity of the source file generation process. This vulnerability maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it facilitates the execution of unintended commands through injected syntax within a graphics format context.