CVE-2026-56379: ImageMagick RCE Vulnerability

CVE-2026-56379 Overview

CVE-2026-56379 is a command injection vulnerability in ImageMagick affecting versions before 7.1.2-15 and 6.9.13-40. The flaw resides in the Scalable Vector Graphics (SVG) decoder, which fails to properly sanitize input before passing it to the Magick Vector Graphics (MVG) drawing engine. Attackers can craft malicious SVG files that inject arbitrary MVG commands executed during image rendering. Because ImageMagick is widely deployed as a backend image processor in web applications, content management systems, and document pipelines, exploitation can occur through standard image upload workflows. The vulnerability is classified under [CWE-116] Improper Encoding or Escaping of Output.

Critical Impact
Remote attackers can inject arbitrary MVG drawing commands through crafted SVG files, leading to unintended operations during image processing on servers that accept user-supplied SVG content.

Affected Products

ImageMagick versions prior to 7.1.2-15
ImageMagick 6.x versions prior to 6.9.13-40
Applications and services embedding vulnerable ImageMagick libraries for SVG processing

Discovery Timeline

2026-06-23 - CVE-2026-56379 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56379

Vulnerability Analysis

The vulnerability resides in ImageMagick's SVG decoder pathway. When ImageMagick processes an SVG file, it translates SVG drawing primitives into MVG commands, which are then handed to the internal drawing engine. The decoder does not adequately escape or validate certain SVG attribute values before incorporating them into the generated MVG command stream. An attacker who controls portions of the SVG content can break out of the intended MVG context and inject additional drawing directives. The injected commands execute with the same privileges as the ImageMagick process. Server-side deployments that automatically convert user-uploaded SVG files are the primary exploitation target. The current EPSS score is 0.847%, placing the CVE in the 53rd percentile for exploitation likelihood.

Root Cause

The root cause is improper encoding of output ([CWE-116]) within the SVG-to-MVG translation logic. SVG attribute values that should be treated as literal data are concatenated directly into MVG command strings without sufficient escaping of delimiters such as quotes, newlines, and command separators. This allows attacker-controlled content to be reinterpreted as MVG syntax rather than as drawing parameters.

Attack Vector

The vulnerability is exploitable over the network through any application that passes user-supplied SVG content to ImageMagick. Typical attack flows include image upload endpoints, thumbnail generation services, document converters, and avatar processors. The attacker crafts an SVG file containing carefully constructed attribute values that, when translated into MVG, introduce attacker-controlled drawing commands. No authentication or user interaction is required when the target application processes the SVG automatically. See the GitHub Security Advisory and VulnCheck Advisory for additional technical context.

Detection Methods for CVE-2026-56379

Indicators of Compromise

SVG files containing unusual MVG-related keywords such as push, pop, image, or fill embedded within attribute values
SVG uploads with abnormally long attribute strings, embedded quote characters, or newline sequences inside attribute values
Unexpected file reads or writes by the convert, magick, or identify processes following SVG processing
ImageMagick process spawning child processes that are not part of normal conversion pipelines

Detection Strategies

Inspect SVG uploads before processing and flag files containing suspicious MVG tokens within SVG attributes
Monitor process telemetry for ImageMagick binaries performing file system operations outside their working directories
Apply YARA or content rules that match patterns of MVG injection inside SVG payloads
Correlate web server upload logs with downstream ImageMagick process activity to identify abnormal conversion behavior

Monitoring Recommendations

Centralize logs from image processing services and forward them to a SIEM for behavioral analysis
Track ImageMagick version inventory across servers and container images to identify unpatched instances
Enable file integrity monitoring on directories accessed by ImageMagick worker processes
Alert on outbound network connections originating from image conversion workers, which should typically be isolated

How to Mitigate CVE-2026-56379

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-15 or later, or 6.9.13-40 or later for the 6.x branch
Audit all applications that accept SVG uploads and confirm the ImageMagick version in use
Disable SVG processing in ImageMagick if it is not required by the application
Restrict image conversion workers using container isolation, seccomp, or AppArmor profiles

Patch Information

The ImageMagick maintainers released fixed versions 7.1.2-15 and 6.9.13-40 that correct the encoding logic in the SVG decoder. Operators should pull the patched packages from their distribution maintainers or rebuild from the upstream source. Container image rebuilds are required for deployments using ImageMagick inside Docker or Kubernetes workloads. Details are provided in the GitHub Security Advisory GHSA-xpg8-7m6m-jf56.

Workarounds

Disable the SVG coder in policy.xml to prevent ImageMagick from processing SVG files at all
Route SVG processing through a hardened renderer such as rsvg-convert instead of ImageMagick
Apply strict MIME and content validation on uploaded files and reject SVG content that contains MVG-related tokens
Run ImageMagick in a sandboxed, network-isolated environment with minimal file system privileges

bash

# Configuration example: disable SVG and MVG coders in ImageMagick policy.xml
# Edit /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="SVG" />
  <policy domain="coder" rights="none" pattern="MVG" />
  <policy domain="coder" rights="none" pattern="MSVG" />
</policymap>