CVE-2026-56379: ImageMagick - Command Injection via SVG Decoder

Synopsis

Command injection in ImageMagick's SVG decoder allows an attacker to embed arbitrary Magick Vector Graphics (MVG) commands inside a crafted SVG file. The vulnerability is reachable over the network with no authentication required, and exploitation succeeds when ImageMagick renders the malicious file. Successful exploitation gives the attacker full read, write, and denial-of-service capability against the host process. Patched-image rebuilds at versions 6.9.13-40 and 7.1.2-15 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to deliver a crafted SVG file to a service that passes it to ImageMagick for rendering, exposing the vulnerability over the network.

• AuthenticationNot required

  No credentials or session token are needed; any unauthenticated request that triggers SVG rendering is sufficient.

• Victim interactionNot required

  No user action is required; exploitation occurs automatically when the server-side ImageMagick process renders the malicious file.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must satisfy specific preconditions such as timing constraints or particular processing states before the injected MVG commands execute reliably.

Blast Radius

• Reads arbitrary files accessible to the ImageMagick process, including application secrets and credentials stored on disk.
• Writes or overwrites files within the process's reach, allowing the attacker to tamper with application data or drop malicious content.
• Crashes or hangs the ImageMagick rendering process, disrupting any service that depends on image processing.
• Depending on deployment context, injected MVG commands may invoke shell primitives that pivot to broader host compromise.