Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-109275

Fixed in a distro release EPSS <1%CVSS 4.8

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path.

Published 2026-10-12 · CVE record · OSV

Products: imagemagick

Distro releases

ReleasePackageFixed in
Debian 12imagemagickno fix
Debian 13imagemagickno fix
Debian 14imagemagickno fix
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 12 SP5-LTSSImageMagick6.8.8.1-71.280.1
SUSE Linux Enterprise Server 15 SP4-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 15 SP5-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server 15 SP6-LTSSImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5ImageMagick6.8.8.1-71.280.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5ImageMagick7.1.0.9-150400.6.122.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6ImageMagick7.1.0.9-150400.6.122.1
Ubuntu 26.10imagemagickno fix
Ubuntu Pro 14.04 LTSimagemagickno fix
Ubuntu Pro 16.04 LTSimagemagickno fix
Ubuntu Pro 18.04 LTSimagemagickno fix
Ubuntu Pro 20.04 LTSimagemagickno fix
Ubuntu Pro 22.04 LTSimagemagickno fix
Ubuntu Pro 24.04 LTSimagemagickno fix
Ubuntu Pro 26.04 LTSimagemagickno fix
openSUSE TumbleweedImageMagick7.1.2.34-1.1