CVE-2026-105399 ImageMagick CVE debrief

Who should care

Defenders managing ImageMagick installations, particularly those using versions before 7.1.2-31 or 6.9.13-56, should assess exposure and prioritize remediation. This includes operators responsible for maintaining ImageMagick deployments, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of image processing operations.

Why it matters

CVE-2026-105399 is a medium-severity denial of service vulnerability in ImageMagick's MVG decoder. Defenders should verify and apply patches, monitor for crafted images, and assess exposure to prevent potential CPU resource exhaustion and image processing stalls.

• Verify and apply patches to prevent denial of service
• Monitor image processing for excessive CPU consumption
• Assess exposure and prioritize remediation for ImageMagick installations

Technical summary

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image processing. This vulnerability allows for potential CPU resource exhaustion and image processing stalls if left unremediated. The vulnerability is particularly concerning for defenders managing ImageMagick installations, as it can be exploited to cause significant disruptions.

Defensive priority

Medium

Recommended defensive actions

• Verify ImageMagick version and assess exposure
• Apply vendor patches or updates
• Monitor for crafted MVG images
• Consider compensating controls for image processing
• Review and update asset inventory for ImageMagick installations
• Track and manage exceptions for remediation of exposed systems
• Implement monitoring for excessive CPU consumption and image processing stalls

Evidence notes

Official CVE Program record and vendor advisory detail a denial of service vulnerability in ImageMagick before 7.1.2-31. The MVG decoder lacks a limit check, allowing crafted images to cause excessive CPU consumption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.