ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-400"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106573.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.2-31"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "c311471c4e4978494834c707b417bc033d95cc48"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "7.1.2-31",
"range": [
{
"fixed": "fb965f1b54a65ddb633f8c2eac4452c782c66d7f"
}
],
"source": "REFERENCES_TAG"
}
]
}
{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.9.13-56"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "49560a1641f72a127e413b9861eca0997fde2b96"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "6.9.13-56",
"range": [
{
"fixed": "2f16e94c5ecb1256496a20d1ecdcaf53aeb1a4ce"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-106573.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"26132502670455756563091793782988627603",
"121001219282007992728454023626854885231",
"22843193800157275803407578057017676090",
"132498483711203485337813964568204682129",
"306153820329463180587599548500610160404",
"173359790568741878479036087421027971361",
"14814626963741140221876800692069082580",
"132843095662160795924985387425512821751",
"64931134262208253494384977483306798717",
"282852592153161624011144728662135428935",
"145111812634514632607360214037285136774",
"83268797816428019438282704180193161335",
"232507429174971514025038766749029832771",
"151203330155722667460670582169277647779",
"131192487322001422331508969697378448203",
"154106957572189396930617397471146689154",
"85273357478067111881631057966036443833",
"24588194789440647672083496270265867067",
"112073670474988655069248369887255813608"
],
"threshold": 0.9
},
"id": "CVE-2026-106573-0d915614",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/c311471c4e4978494834c707b417bc033d95cc48",
"target": {
"file": "MagickCore/draw.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "133060392992713891046696866934807367543",
"length": 126
},
"id": "CVE-2026-106573-0da51edf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/c311471c4e4978494834c707b417bc033d95cc48",
"target": {
"file": "MagickCore/draw.c",
"function": "DrawImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "249102894353370912530956462872500257574",
"length": 4545
},
"id": "CVE-2026-106573-2308d077",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/c311471c4e4978494834c707b417bc033d95cc48",
"target": {
"file": "MagickCore/draw.c",
"function": "CloneDrawInfo"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "327746234312198926048098850209042512882",
"length": 49205
},
"id": "CVE-2026-106573-2ce12f49",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/c311471c4e4978494834c707b417bc033d95cc48",
"target": {
"file": "MagickCore/draw.c",
"function": "RenderMVGContent"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"11895839116564764825542722584335751679",
"170941933538950821180044351851633084245",
"258649947406567870101814086696808438779",
"120603552872648874097341646687360929834"
],
"threshold": 0.9
},
"id": "CVE-2026-106573-4ee54c94",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/c311471c4e4978494834c707b417bc033d95cc48",
"target": {
"file": "MagickCore/draw.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "30888004742001887091041882401204860365",
"length": 4782
},
"id": "CVE-2026-106573-62ea75b3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96",
"target": {
"file": "magick/draw.c",
"function": "CloneDrawInfo"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"315887640846964516238205273989263388228",
"8120478874984082528379411042691198487",
"258649947406567870101814086696808438779",
"120603552872648874097341646687360929834"
],
"threshold": 0.9
},
"id": "CVE-2026-106573-630eee17",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96",
"target": {
"file": "magick/draw.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "96286857988204172700814291906455221792",
"length": 48248
},
"id": "CVE-2026-106573-8118527d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96",
"target": {
"file": "magick/draw.c",
"function": "RenderMVGContent"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "244649241310496454094385573639124979240",
"length": 4109
},
"id": "CVE-2026-106573-85acf07d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick/commit/c311471c4e4978494834c707b417bc033d95cc48",
"target": {
"file": "MagickCore/draw.c",
"function": "GetDrawInfo"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166132970650433764937340799365909416493",
"174515577204353066853108590252698768786",
"237398709754023350828750452071348297274",
"105809653463676546802728585107504148800",
"115187326469859889576437448625152498742",
"203994979837772178551504088234406779351",
"11386806355529224687789287660477674367",
"132843095662160795924985387425512821751",
"64931134262208253494384977483306798717",
"236751735486198895374466791903353998235",
"219035411577772473800650112452126641734",
"75372327558370678170638235951513392569",
"106421616049087112571477617407387096022",
"271122288771888116121654735319320135185",
"245037478566639621801084061368965325251",
"154106957572189396930617397471146689154",
"235878902534585522859538371261269773413",
"203676683929829338260184052617707954892",
"32491018421336852323136593570585018704"
],
"threshold": 0.9
},
"id": "CVE-2026-106573-d2e9b594",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96",
"target": {
"file": "magick/draw.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4555751073184125070314568606944546601",
"length": 102
},
"id": "CVE-2026-106573-e60d09f9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96",
"target": {
"file": "magick/draw.c",
"function": "DrawImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "141395380514428365266407032871341007692",
"length": 3867
},
"id": "CVE-2026-106573-f3188347",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/imagemagick/imagemagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96",
"target": {
"file": "magick/draw.c",
"function": "GetDrawInfo"
}
}
]
"2026-10-16T09:30:25Z"