PT-2026-122989

CVE-2026-116148

Published

2026-10-25

Updated

2026-10-30

Description by

CVSS 4.0

4.8

Medium

MetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-58 ImageMagick versions prior to 7.1.2-33

Description An injection issue exists in the MVG encoder that fails to properly neutralize user-specified drawing options before writing them into the generated MVG output. This allows attackers who can provide drawing options to inject arbitrary MVG drawing commands into the resulting MVG file.

Recommendations Update ImageMagick to version 6.9.13-58 or later. Update ImageMagick to version 7.1.2-33 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Bewithyash

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers