CVE-2026-109264
Fixed in a distro release EPSS <1%CVSS 3.7
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.
Products: imagemagick
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | imagemagick | no fix |
| Debian 13 | imagemagick | no fix |
| Debian 14 | imagemagick | no fix |
| Ubuntu 26.10 | imagemagick | no fix |
| Ubuntu Pro 14.04 LTS | imagemagick | no fix |
| Ubuntu Pro 16.04 LTS | imagemagick | no fix |
| Ubuntu Pro 18.04 LTS | imagemagick | no fix |
| Ubuntu Pro 20.04 LTS | imagemagick | no fix |
| Ubuntu Pro 22.04 LTS | imagemagick | no fix |
| Ubuntu Pro 24.04 LTS | imagemagick | no fix |
| Ubuntu Pro 26.04 LTS | imagemagick | no fix |
| openSUSE Tumbleweed | ImageMagick | 7.1.2.34-1.1 |