CVE-2026-116148
Description
A flaw was found in ImageMagick. The Magick Vector Graphics (MVG) encoder does not properly neutralize user-specified drawing options before writing them into generated output. An attacker capable of supplying drawing options can exploit this vulnerability to inject arbitrary drawing commands into the resulting MVG file, potentially leading to unauthorized information disclosure.
Statement
This flaw is rated as a Low severity issue for Red Hat products because exploitation requires targeted user interaction or an application accepting untrusted drawing parameters, restricting the impact to injecting formatting directives into generated vector files. The vulnerability does not allow direct arbitrary system command execution or service disruption, confining the blast radius to minor data exposure within the rendered vector context. Furthermore, ImageMagick is utilized as a standalone utility or library rather than an exposed network daemon in typical Red Hat Enterprise Linux deployments.
Mitigation
Disable the MVG coder in the ImageMagick security policy configuration.
Add the following policy directive inside the `<policymap>` block in `/etc/ImageMagick-6/policy.xml` (or `/etc/ImageMagick/policy.xml` depending on the installation):
xml
<policy domain="coder" rights="none" pattern="MVG" />
Caveats:
Disabling the MVG coder prevents ImageMagick from processing, rendering, or generating Magick Vector Graphics files, which may impact applications relying on this format. If ImageMagick is invoked by background application services or web servers (such as httpd or php-fpm), restart those services after modifying the configuration file.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.6 | N/A | 3.6 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
