Technical impact
ImageMagick versions before 6.9.13‑58 and 7.x before 7.1.2‑33 contain an injection flaw in the MVG encoder. The encoder does not neutralize user‑specified drawing options before writing them into the generated MVG output, so an attacker who can supply drawing options can inject arbitrary MVG drawing commands into the resulting file. This flaw could allow malicious commands to be executed by any process that later interprets the injected drawing commands, representing a code injection vulnerability.
Affected Systems
All ImageMagick installations running a version earlier than 6.9.13‑58 or any 7.x release prior to 7.1.2‑33 are affected when the MVG encoder processes images.
Risk and Exploitability
The CVSS score of 4.8 indicates moderate severity, and the availability of an EPSS metric or KEV listing is not reported, so the likelihood of exploitation is uncertain. Attackers must be able to supply drawing options, which can occur through malicious image uploads or other input vectors that reach the MVG encoder. While no active exploits are known, injection of arbitrary MVG commands could lead to unintended operations or further exploitation if those files are processed by downstream viewers or converters.
Debian DLA