ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. (CVE-2026-109275)

A code injection vulnerability exists in ImageMagick's MVG decoder for versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32 when a PostScript renderer is used. An attacker can craft a malicious MVG file that, upon decoding, injects code into the PostScript rendering process. This flaw is tracked as CVE-2026-109275 and is associated with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The vulnerability has a CVSS v3.1 base score of 4.8, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability allows code injection into the PostScript rendering path, which can lead to limited integrity and availability impacts. There is no confidentiality impact reported. The attack complexity is high, and no privileges or user interaction are required for exploitation.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, avoid processing untrusted MVG files with a PostScript renderer in affected versions.