ImageMagick versions before 6.9.13‑57 and 7.x before 7.1.2‑32 contain a code injection flaw in the MVG decoder that is triggered when the PostScript rendering engine is used. A malicious user can embed crafted MVG payloads that cause the decoder to inject arbitrary code into the PostScript rendering path during normal image processing. The injected code can execute with the privileges of the ImageMagick process, potentially enabling the attacker to run commands, exfiltrate data, or modify files.

Systems vulnerable to this problem are those that run any of the affected ImageMagick releases. The affected lineages include ImageMagick 6 up to but not including 6.9.13‑57 and the 7.x branch up to but not including 7.1.2‑32. Any application that loads or converts images using these libraries and enables the PostScript renderer is at risk, particularly services exposed to untrusted users, such as web image upload, collaborative document conversion, or remote rendering services.

The CVSS score of 6.3 classifies the vulnerability as moderate, and the absence of an EPSS entry and lack of listing in CISA's KEV suggest exploitation is not widely observed, although the attack requires only the delivery of a crafted MVG file. Since the flaw hijacks the PostScript rendering path, an attacker who can submit or force the processing of a malicious MVG file can potentially achieve arbitrary code execution on the host running ImageMagick. Adequate patching, disabling of vulnerable features, or isolated execution are therefore prudent measures.