CVE-2026-106578 PUBLISHED

ImageMagick: Invalid Memory Free in MVG decoder

Assigner: GitHub_M
Reserved: 06.10.2026 Published: 07.10.2026 Updated: 07.10.2026

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.9

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	ImageMagick
Product	ImageMagick
Versions	Version < 6.9.13-56 is affected Version >= 7.0.0, < 7.1.2-31 is affected

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39
https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378
https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31
https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56

Problem Types

CWE-590: Free of Memory not on the Heap CWE