CVE-2026-105399

ImageMagick: ImageMagick: Denial of Service via missing limit check in MVG decoder

Published Oct 8, 2026 CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected as a duplicate.

No data.

No data available yet.

No solution or workaround provided in the CVE record

No advisories available

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62
https://nvd.nist.gov/vuln/detail/CVE-2026-105399
https://www.cve.org/CVERecord?id=CVE-2026-105399
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-denial-of-service-via-mvg-decoder

History

Type	Values Removed	Values Added
Title	ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder	ImageMagick: ImageMagick: Denial of Service via missing limit check in MVG decoder
Metrics	cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description	ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image processing.	This CVE ID has been rejected as a duplicate.
CPEs	cpe:2.3:a:imagemagick:imagemagick::::::::
Metrics	cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Type	Values Removed	Values Added
Weaknesses		CWE-606
References		https://nvd.nist.gov/vuln/detail/CVE-2026-105399 https://www.cve.org/CVERecord?id=CVE-2026-105399
Metrics	threat_severity `None`	threat_severity `Moderate`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image processing.
Title		ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-400
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62 https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-31-denial-of-service-via-mvg-decoder
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`