CVE-2026-48734: ImageMagick Stack Overflow in MVG File Parsing

Technical summary

CVE-2026-48734 is a stack overflow vulnerability in ImageMagick's MVG file parsing logic, stemming from missing depth checks and absence of a visited-set mechanism during recursive processing. When ImageMagick parses a crafted MVG file, it recursively processes nested structures without bounds, exhausting the call stack. The root cause is CWE-674 (Uncontrolled Recursion). The issue affects ImageMagick versions prior to 6.9.13-49 (legacy branch) and 7.1.2-24 (current branch). Exploitation is local-only and requires user action to open the malicious file.

Business impact

ImageMagick is integral to many image processing workflows, from web service backends that auto-generate thumbnails to desktop publishing tools. A successful exploit causes denial of service—the affected application crashes when processing the malicious file. In server environments where ImageMagick handles untrusted user uploads, this could be exploited to disrupt service availability. Organizations relying on ImageMagick for batch image processing or automated workflows may experience unexpected application hangs. However, the impact is limited to availability; no data theft, corruption, or privilege escalation is possible.

Affected systems

ImageMagick versions prior to 6.9.13-49 and 7.1.2-24 are affected. This includes both the legacy 6.9.x series and the current 7.1.x series. Any system running an older release—including Linux distributions with outdated packages, Docker images built on older base images, and standalone installations—is vulnerable when processing untrusted MVG files. Organizations should audit their ImageMagick deployment versions across development, testing, and production environments.

Exploitability

Exploitation requires local file access and user interaction; the vulnerability cannot be triggered remotely by default. An attacker would need to either place a malicious MVG file where a user is likely to open it (via email, download, shared storage) or compromise a system where an automated service processes untrusted image files. If ImageMagick is exposed via a web service that converts or resizes user-supplied images, the risk is elevated. The CVSS score of 5.5 (Medium) reflects the local-only attack vector and requirement for user action, balanced against the guaranteed availability impact.

Remediation

Organizations should upgrade ImageMagick to version 6.9.13-49 or later (if using the 6.9.x branch) or 7.1.2-24 or later (if using the 7.1.x branch). Before upgrading, test in a staging environment to ensure compatibility with dependent applications. For systems where immediate patching is not feasible, implement input validation to reject suspicious or untrusted MVG files, disable MVG format support if not required, or restrict ImageMagick access to trusted image sources only.

Patch guidance

Consult the official ImageMagick release notes and security advisories to confirm the exact patch versions for your deployment. Verify against the vendor advisory that the version you plan to deploy is indeed 6.9.13-49 or 7.1.2-24 or later. Test patches in a non-production environment first, particularly if ImageMagick is embedded in third-party applications or custom scripts. Many Linux distributions provide backported patches; check your vendor's security bulletin for the specific package version available in your repository.

Detection guidance

Monitor for unexpected ImageMagick process crashes or high CPU/memory usage when processing image files. Log file open attempts and processing errors; look for references to MVG files in error logs. If feasible, analyze incoming MVG files for suspicious recursive or deeply nested structures before processing. Intrusion detection systems with image file inspection capabilities may flag malformed MVG headers. In containerized environments, watch for container restarts or OOM kills triggered by ImageMagick tasks.

Why prioritize this

This vulnerability merits prompt but not emergency action. It is a medium-severity denial-of-service issue with no data breach or code execution risk. However, organizations that process user-supplied images—particularly web services, content management systems, and automated image conversion pipelines—should prioritize patching. The low barrier to exploitation (user opens a file) and widespread use of ImageMagick make this a meaningful risk if your threat model includes user-supplied image processing. For organizations that do not process untrusted MVG files or have strong input validation in place, the risk is lower.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: Attack Vector (Local) and low Attack Complexity, combined with a guaranteed Availability impact. No authentication is required, and user interaction is necessary but expected (opening a file). Confidentiality and Integrity are not affected. The Medium severity is appropriate for a denial-of-service vulnerability that disrupts availability without exposing data or enabling privilege escalation.

Frequently asked questions