CVE-2026-109275

4.8Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.8Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-74

Impact

Attackers can achieve unauthorized code injection into the PostScript rendering path by submitting a crafted MVG file. This can lead to low-level integrity compromise and denial of service on systems that process untrusted images.

Root cause

The MVG decoder improperly sanitizes input before passing it to the PostScript renderer, allowing code injection.

Affected systems

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

Upgrade to ImageMagick 6.9.13-57, 7.1.2-32, or later. If patching immediately is not possible, disable the MVG and PostScript coders via ImageMagick's policy.xml configuration.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109275