CVE-2026-116144

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder

Published Oct 25, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service.

Analysis

Technical impact

The vulnerability stems from uncontrolled recursion in the MVG decoder, which can cause a stack overflow when a crafted MVG file is processed with certain arguments. This leads to an application crash, disrupting service availability. The weakness is classified as CWE-674, involving improper restrictions of operations within a stack buffer, and also as CWE-770. The CVE description confirms that the result is a denial of service rather than a compromise of confidentiality or integrity.

Affected Systems

The issue affects ImageMagick versions prior to 6.9.13‑58 and 7.x prior to 7.1.2‑33. Systems running these releases and processing MVG files are impacted, regardless of vendor or platform; only the specific ImageMagick package versions are required.

Risk and Exploitability

The CVSS score of 4.8 places the vulnerability in the medium severity range. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no known exploitation. Attackers would need to supply a malicious MVG file to an execution environment that reads such files with the vulnerable arguments, indicating a local or service‑specific attack surface. If an external party can influence file processing, remote denial of service could be achievable.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`7.0.0-0`	affected	< 7.1.2-33
`7.1.2-33`	unaffected	—

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 6.9.13-58
`6.9.13-58`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:imagemagick:imagemagick::::::::
	cpe:2.3:a:imagemagick:imagemagick::::::::

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[7.0.0-0,7.1.2-33)`	affected	semver	—
`7.1.2-33`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,6.9.13-58)`	affected	semver	—
`6.9.13-58`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ImageMagick to version 6.9.13‑58 or later, or 7.1.2‑33 or later, to eliminate the recursion flaw.
If upgrading immediately is not possible, restrict usage of MVG files or disable the MVG decoder in the application configuration to prevent exploitation.
Monitor application logs for stack overflow crashes and apply the available patch as soon as it becomes available.

Generated by OpenCVE AI on October 26, 2026 at 01:27 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4875-1	imagemagick security update

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.123% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x258-xjqf-6j3f
https://nvd.nist.gov/vuln/detail/CVE-2026-116144
https://www.cve.org/CVERecord?id=CVE-2026-116144
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-overflow-via-mvg-decoder

History

Oct 26, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116144 https://www.cve.org/CVERecord?id=CVE-2026-116144
Metrics	threat_severity `None`	threat_severity `Low`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service.
Title		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-674
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x258-xjqf-6j3f https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-overflow-via-mvg-decoder
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`