How severe is CVE-2026-106578?

CVE-2026-106578 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-106578 being actively exploited?

It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.

How do I fix CVE-2026-106578?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-106578 published?

CVE-2026-106578 was published on 2026-10-07.

CVE-2026-106578

CVE-2026-106578 is a medium-severity vulnerability with a CVSS 3.x base score of 5.9. The underlying weakness is classified as CWE-590.

Key facts

Severity: Medium (CVSS 3.x base score 5.9)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-590
Published: 2026-10-07
Last modified: 2026-10-07

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Frequently asked questions

What is CVE-2026-106578?: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.
How severe is CVE-2026-106578?: CVE-2026-106578 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-106578 being actively exploited?: It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
How do I fix CVE-2026-106578?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-106578 published?: CVE-2026-106578 was published on 2026-10-07.

References

Other CWE-590 vulnerabilities

CVE-2026-76465 — Critical (CVSS 9.8): A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco…
CVE-2026-95311 — Critical (CVSS 9.6): Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social…
CVE-2025-32911 — Critical (CVSS 9.0): A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition()…
CVE-2026-20810 — High (CVSS 7.8): Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to…
CVE-2025-54899 — High (CVSS 7.8): Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-42995 — High (CVSS 7.5): SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read…

Browse all CWE-590 vulnerabilities →