CVE-2026-106573

MEDIUM 5.3

ImageMagick: Denial of service in MVG decoder

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

CWE	CWE-400
Vendor	imagemagick
Product	imagemagick
Published	Oct 7, 2026

Stay Ahead of the Next One

Get instant alerts for imagemagick imagemagick

Be the first to know when new medium vulnerabilities affecting imagemagick imagemagick are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

ImageMagick / ImageMagick

< 6.9.13-56 >= 7.0.0, < 7.1.2-31

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62 github.com: https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48 github.com: https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96 github.com: https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31 github.com: https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56