This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-56379 →
DEBIAN-CVE-2026-56379
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG...
Original description
The description as published by the source.
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
graphicsmagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
graphicsmagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
graphicsmagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.49-1"}]}]
Debian:12
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.6+deb12u8"}]}]
Debian:13
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.1.43+dfsg1-1+deb13u8"}]}]
Debian:14
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.15+dfsg1-1"}]}]
References
- advisory security-tracker.debian.org