CVE-2026-106573 PUBLISHED

ImageMagick: Denial of service in MVG decoder

Assigner: GitHub_M
Reserved: 06.10.2026 Published: 07.10.2026 Updated: 07.10.2026

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	ImageMagick
Product	ImageMagick
Versions	Version < 6.9.13-56 is affected Version >= 7.0.0, < 7.1.2-31 is affected

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62
https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48
https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31
https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56

Problem Types

CWE-400: Uncontrolled Resource Consumption CWE