CVE-2026-105824: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-105824 is a use-after-free vulnerability in the RSVG decoder of ImageMagick when built without cairo support, triggered when a decoding limit is hit during SVG file processing. It affects ImageMagick versions before 6.9.13-55 (6.x branch) and before 7.1.2-30 (7.x branch). The CVE has been marked as Rejected (duplicate) by the CVE authority, with the canonical advisory being GHSA-f2r2-qw7g-3c8x / CVE-2026-107209. It carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, ImageMagick Advisory).

The root cause is a use-after-free (CWE-416) and expired pointer dereference (CWE-825) in ImageMagick's RSVG decoder code path that is compiled without cairo support. When processing an SVG file, if a configured resource or processing limit is reached mid-decode, memory is freed prematurely; subsequent code paths then access that freed memory, causing undefined behavior and a crash. The attack vector is network-based and requires no authentication or user interaction, though high attack complexity is noted due to the need to trigger a specific limit condition. The vulnerability was reported by researcher Yanhaoxi (ImageMagick Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial of service — the ImageMagick process crashes upon accessing freed memory, disrupting any image processing workflow that handles SVG files. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Services or applications that accept user-supplied SVG files and process them through a cairo-less ImageMagick build are at risk of repeated crashes, potentially causing sustained service outages (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.25% (15th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (GitHub Advisory, VulnCheck Advisory).

1. Identify target: Locate a service or application that accepts SVG file uploads and processes them using ImageMagick built without cairo support (versions before 6.9.13-55 or 7.1.2-30).
2. Craft malicious SVG: Create a specially crafted SVG file designed to trigger ImageMagick's internal resource or processing limits during RSVG decoding (e.g., deeply nested elements, excessive complexity, or large resource references).
3. Submit the file: Upload or supply the crafted SVG to the target application's image processing endpoint via HTTP or another network interface.
4. Trigger the crash: ImageMagick's RSVG decoder hits the configured limit, frees memory, and then accesses the freed pointer — causing a process crash and denial of service to legitimate users (ImageMagick Advisory, Red Hat Bugzilla).

• Logs: Repeated ImageMagick process crashes or segmentation fault entries in application or system logs (e.g., SIGSEGV or Aborted signals from the ImageMagick process); error messages referencing RSVG decoder or SVG processing failures.
• File System: Presence of unusual or malformed SVG files in upload directories or temporary processing directories.
• Process: Unexpected termination of ImageMagick worker processes; core dump files (core.*) generated in the working directory of the image processing service.
• Network: Repeated submission of SVG files from the same source IP to image upload or processing endpoints, particularly files that consistently cause process crashes.

Upgrade ImageMagick to version 6.9.13-55 or later (6.x branch) or 7.1.2-30 or later (7.x branch) to remediate the vulnerability. If immediate patching is not feasible, disable SVG file processing or restrict access to ImageMagick's SVG/RSVG functionality. Alternatively, rebuilding ImageMagick with cairo support eliminates the vulnerable code path entirely. Restricting untrusted SVG file uploads at the application layer is an additional defensive measure (ImageMagick Advisory, GitHub Advisory).

The vulnerability was reported by researcher Yanhaoxi and published by ImageMagick maintainer dlemstra via a GitHub Security Advisory. Red Hat tracked the issue via Bugzilla (Bug 2547987) and assigned it medium severity. No significant broader media coverage or notable community commentary beyond standard vulnerability tracking has been observed (ImageMagick Advisory, Red Hat Bugzilla).