Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
Published: 2026-10-07
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via process crash
Action: Immediate Patch
AI Analysis

Impact

A crafted MVG image triggers an invalid memory free in ImageMagick's MVG decoder, causing the image‑processing process to crash. The flaw corresponds to CWE‑590 and CWE‑763, where memory is released after it has already been freed and a structure pointer is dereferenced after it has been freed, leading to instability and denial of service rather than direct data loss or compromise.

Affected Systems

ImageMagick ImageMagick releases prior to 7.1.2‑31 and 6.9.13‑56 are affected. The documented patches are included in version 7.1.2‑31 and 6.9.13‑56, respectively, and applied GitHub commits and release links confirm the remediation.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack is likely possible when an attacker supplies a malicious image to any component that uses the MVG decoder, which could be an external image upload endpoint or any untrusted image source. The exploit would result in a crash, causing a denial of service to the affected process or service.

Generated by OpenCVE AI on October 8, 2026 at 13:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to version 7.1.2‑31 or later, or to 6.9.13‑56 or later for the 6.x branch
  • After upgrading, configure the software to reject or safely handle MVG image files from untrusted sources, or disable MVG decoding if it is not required
  • As a temporary measure, apply the recommended patch commits referenced in the official advisory to any custom or forked ImageMagick installations that cannot be updated immediately

Generated by OpenCVE AI on October 8, 2026 at 13:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4858-1 imagemagick security update
History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Sat, 10 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-763
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Imagemagick
Imagemagick imagemagick
Vendors & Products Imagemagick
Imagemagick imagemagick

Wed, 07 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
Title ImageMagick: Invalid Memory Free in MVG decoder
Weaknesses CWE-590
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-10T02:34:33.075Z

Reserved: 2026-10-06T20:31:59.017Z

Link: CVE-2026-106578

cve-icon Vulnrichment

Updated: 2026-10-10T02:34:28.264Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-07T16:17:44.217

Modified: 2026-10-21T15:59:27.767

Link: CVE-2026-106578

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-07T15:41:10Z

Links: CVE-2026-106578 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T14:00:05Z

Weaknesses
  • CWE-590

    Free of Memory not on the Heap

  • CWE-763

    Release of Invalid Pointer or Reference