CVE-2026-107209

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-30 ImageMagick versions prior to 6.9.13-55

Description When built without Cairo support, the RSVG decoder can be triggered to free image state twice and subsequently use that freed memory when processing a crafted RSVG image that reaches a resource limit, leading to a process crash. This is a use-after-free condition, which occurs when a program continues to use a pointer after it has been freed.

Recommendations Update to version 7.1.2-30 or later. Update to version 6.9.13-55 or later.