| Name | CVE-2026-56379 |
| Description | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1153352 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| graphicsmagick (PTS) | bookworm, bookworm (security) | 1.4+really1.3.40-4+deb12u1 | vulnerable |
| trixie | 1.4+really1.3.45+hg17696-1 | vulnerable | |
| forky, sid | 1.4+really1.3.49-1 | fixed | |
| imagemagick (PTS) | bookworm | 8:6.9.11.60+dfsg-1.6+deb12u11 | fixed |
| bookworm (security) | 8:6.9.11.60+dfsg-1.6+deb12u15 | fixed | |
| trixie | 8:7.1.1.43+dfsg1-1+deb13u12 | fixed | |
| trixie (security) | 8:7.1.1.43+dfsg1-1+deb13u14 | fixed | |
| forky | 8:7.1.2.34+dfsg1-1 | fixed | |
| sid | 8:7.1.2.35+dfsg1-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| graphicsmagick | source | (unstable) | 1.4+really1.3.49-1 | 1153352 | ||
| imagemagick | source | bullseye | 8:6.9.11.60+dfsg-1.3+deb11u11 | |||
| imagemagick | source | bookworm | 8:6.9.11.60+dfsg-1.6+deb12u8 | |||
| imagemagick | source | trixie | 8:7.1.1.43+dfsg1-1+deb13u8 | |||
| imagemagick | source | (unstable) | 8:7.1.2.15+dfsg1-1 |
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/f63c78b3828933f1cc7cf499390248981af765aa (7.1.2-14)
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/9db96365ecab5de69cdec81b9359672b3a827aaa (7.1.2-14)
Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/4b7a043eb0fdf233ea9ecf237bcb009c16a354cd (6.9.13-39)
Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/b4a7adf48e723ab73d2337ada34ee0fee7337250 (6.9.13-39)
Fixed by: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/d70680f531c745c6b15cda843cd3f40427c6f99f
bookworm/bullseye fixed by backporting svg/msl coder from 6.9.13-41
trixie fixed by backporting svg/msl to 7.1.2-16