CVE-2026-48734 describes a stack overflow vulnerability in the MVG decoder component of Magick.NET-Q16-AnyCPU. The issue arises from the absence of proper depth or visited-set checks when parsing specially crafted MVG files, leading to potential stack overflow conditions. This vulnerability is classified under CWE-674 (Improper Control of a Resource Through a Lifetime). The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact. No known exploits are reported in the wild. The affected versions are all versions before 14.14.0.

Successful exploitation can cause a stack overflow resulting in denial of service (application crash or unavailability). There is no reported impact on confidentiality or integrity. The availability impact is high due to potential application crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor vendor communications for updates and avoid processing untrusted MVG files to mitigate risk.