CVE-2026-105824: 
ImageMagick Análisis y mitigación de vulnerabilidades

CVE-2026-105824 is a use-after-free vulnerability in ImageMagick's RSVG decoder that occurs when ImageMagick is built without cairo support. When a decoding limit is reached while processing SVG files, the decoder accesses already-freed memory, resulting in a crash. Affected versions include ImageMagick before 6.9.13-55 (6.x branch) and 7.x before 7.1.2-30. The vulnerability was published on October 8, 2026, and carries a CVSS v3.1 score of 5.9 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), with an additional CWE-415 (Double Free) noted in the upstream advisory (ImageMagick Advisory). The vulnerability is specific to builds of ImageMagick that use the RSVG decoder without cairo support; when cairo support is compiled in, the vulnerable code path is not triggered. An attacker exploits this by supplying a crafted SVG file designed to hit an internal decoding limit, which causes the RSVG decoder to reference freed memory, leading to a crash. No authentication or user interaction is required, though exploitation has high attack complexity due to the specific build configuration and limit-triggering requirements (GitHub Advisory, Red Hat Bugzilla). The vulnerability was reported by researcher Yanhaoxi (ImageMagick Advisory).

Successful exploitation results in a crash of the ImageMagick process, causing a denial of service to any application or workflow relying on ImageMagick for SVG image processing. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (GitHub Advisory). Applications that accept user-supplied SVG files and process them with a non-cairo RSVG-enabled ImageMagick build are at risk of repeated crashes, potentially disrupting image processing pipelines or web services (Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating very low probability of near-term exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that the target ImageMagick installation must be built without cairo support, reducing the overall attack surface.

1. Reconnaissance: Identify applications or services that accept SVG file uploads and process them using ImageMagick (e.g., image conversion APIs, CMS platforms, document processors). Determine whether the target's ImageMagick build uses the RSVG decoder without cairo support — this may be inferred from build flags, package metadata, or error messages.
2. Craft malicious SVG: Create a specially crafted SVG file designed to trigger an internal ImageMagick decoding limit during RSVG processing. The SVG should contain elements or structures that cause resource exhaustion or limit conditions within the decoder.
3. Submit crafted file: Upload or submit the crafted SVG file to the target application's image processing endpoint, causing ImageMagick to invoke the vulnerable RSVG decoder.
4. Trigger crash: When the decoding limit is reached, the use-after-free condition is triggered, causing the ImageMagick process to access freed memory and crash, resulting in denial of service for the affected service (ImageMagick Advisory, GitHub Advisory).

• Logs: Repeated ImageMagick process crashes or segmentation fault errors in application or system logs when processing SVG files; error messages referencing the RSVG decoder or memory access violations.
• File System: Presence of unexpected or malformed SVG files in upload directories or temporary processing folders.
• Process: Abnormal termination of ImageMagick worker processes (e.g., convert, magick) with signal SIGSEGV or SIGABRT when handling SVG input.
• Network: Repeated SVG file submissions from the same source IP to image processing endpoints, particularly if followed by service unavailability.

Upgrade ImageMagick to version 6.9.13-55 or later (for the 6.x branch) or 7.1.2-30 or later (for the 7.x branch) to remediate the vulnerability (ImageMagick Advisory, GitHub Advisory). If immediate patching is not feasible, restrict or disable SVG file processing in ImageMagick, or rebuild ImageMagick with cairo support enabled, which prevents the vulnerable code path from being triggered. Additionally, limit access to image processing endpoints to trusted users or implement file type validation to block SVG uploads where not required (Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their Bugzilla system (Bug 2547987) with a medium severity rating, and it is under active triage for affected Red Hat products (Red Hat Bugzilla). The upstream ImageMagick maintainer (dlemstra) published the security advisory and coordinated the fix (ImageMagick Advisory). No significant broader media coverage or notable community discussion has been observed at this time.