CVE-2026-116148

A flaw was found in ImageMagick. The Magick Vector Graphics (MVG) encoder does not properly neutralize user-specified drawing options before writing them into generated output. An attacker capable of supplying drawing options can exploit this vulnerability to inject arbitrary drawing commands into the resulting MVG file, potentially leading to unauthorized information disclosure.

This flaw is rated as a Low severity issue for Red Hat products because exploitation requires targeted user interaction or an application accepting untrusted drawing parameters, restricting the impact to injecting formatting directives into generated vector files. The vulnerability does not allow direct arbitrary system command execution or service disruption, confining the blast radius to minor data exposure within the rendered vector context. Furthermore, ImageMagick is utilized as a standalone utility or library rather than an exposed network daemon in typical Red Hat Enterprise Linux deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the MVG coder in the ImageMagick security policy configuration.

Add the following policy directive inside the <policymap> block in /etc/ImageMagick-6/policy.xml (or /etc/ImageMagick/policy.xml depending on the installation):

<policy domain="coder" rights="none" pattern="MVG" />

Caveats: Disabling the MVG coder prevents ImageMagick from processing, rendering, or generating Magick Vector Graphics files, which may impact applications relying on this format. If ImageMagick is invoked by background application services or web servers (such as httpd or php-fpm), restart those services after modifying the configuration file.