Medium severity5.3NVD Advisory· Published Oct 8, 2026

CVE-2026-105399

Description

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image processing.

Affected products

ImageMagick/Imagemagickllm-fuzzy
Range: <6.9.13-56, <7.1.2-31

Patches

Vulnerability mechanics

References

github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62nvd
www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-denial-of-service-via-mvg-decodernvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000