ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 contain a flaw in the SVG decoder that permits the injection of arbitrary MVG drawing commands. When a malicious SVG file is processed for rendering, the injected commands are executed by the ImageMagick engine as part of the rendering workflow, potentially altering the produced output in a way defined by the attacker. The vulnerability is classified as a command injection affecting the image conversion process, as indicated by the CWE identifiers for improper encoding (CWE-116) and OS command injection (CWE-78).

All installations of ImageMagick that use the SVG decoder and run versions earlier than 7.1.2-15 or 6.9.13-40 are affected. Vendors deploying ImageMagick 7.x prior to the 7.1.2-15 release or ImageMagick 6.9.13-40 remain at risk. The flaw does not depend on network exposure; it triggers when an SVG file is provided to the ImageMagick toolchain for rendering by any user with file‑system access to the content.

The flaw is a high‑severity vulnerability with a CVSS score of 9.2. The EPSS score is less than 1 %, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attack vectors are limited to the delivery of a crafted SVG file that is subsequently rendered by ImageMagick; no additional privileges or remote capabilities are explicitly required. As the injected commands are interpreted during rendering, the impact is confined to the rendering process and the output it produces.