ImageMagick prior to 7.1.2-15 and 6.9.13-40 suffers from a command injection flaw in its SVG decoder. Attackers can craft SVG files that embed malicious MVG drawing commands which are executed when the image is rendered. This behavior allows the attacker to execute arbitrary system commands within the context of the ImageMagick process, potentially leading to full compromise of the affected host.

The flaw affects all installations of ImageMagick that use the SVG decoder and run versions earlier than 7.1.2-15 or 6.9.13-40. Vendors using ImageMagick versions 7.x before the mentioned patch or 6.9.x before 6.9.13-40 build are vulnerable. The vulnerability is present in any environment where ImageMagick processes SVG files without limitation.

Command injection can be triggered simply by delivering a specially crafted SVG file to an ImageMagick process. Based on the description, it is inferred that the attacker must provide a malicious file, and no additional network privileges are required if the image is processed on a local system. Although an EPSS score is unavailable and the vulnerability has not been catalogued in CISA’s KEV list, the nature of the flaw gives an attacker the ability to run arbitrary code, making the risk significant for any system that accepts untrusted SVG input.