Technical impact
ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 contain a flaw in the SVG decoder that permits the injection of arbitrary MVG drawing commands. When a malicious SVG file is processed for rendering, the injected commands are executed by the ImageMagick engine as part of the rendering workflow, potentially altering the produced output in a way defined by the attacker. The vulnerability is classified as command injection affecting the image conversion process, as indicated by the CWE identifiers for improper encoding (CWE‑116) and OS command injection (CWE‑78).
Affected Systems
All installations of ImageMagick that use the SVG decoder and run versions earlier than 7.1.2-15 or 6.9.13-40 are affected. Vendors deploying ImageMagick 7.x prior to the 7.1.2-15 release or ImageMagick 6.9.13-40 remain at risk. The flaw does not depend on network exposure; it triggers when an SVG file is provided to the ImageMagick toolchain for rendering by any user with file‑system access to the content.
Risk and Exploitability
The flaw is a high‑severity vulnerability with a CVSS score of 9.2. The EPSS score is less than 1 %, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a crafted SVG file that is subsequently rendered by ImageMagick; based on the description it is inferred that no additional privileges or remote capabilities are required. As the injected commands are interpreted during rendering, the impact is confined to the rendering process and the output it produces.
Github GHSA
Ubuntu USN