CVE-2026-116148

CVE-2026-116148CVE-2026-116148

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file.

Scoring

CVSS 3.6 ()
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Last modified2026-10-25
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.