High [CVE-2026-56379] Arbitrary code execution via SVG decoder command injection
This high-severity Red Hat Linux advisory covers CVE-2026-56379 affecting Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Arbitrary code execution via SVG decoder command injection. Red Hat rates this important (CVSS 8.1).
Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:32961 with package ImageMagick-0:6.9.10.68-17.el7_9.
Affected product named by the advisory: Red Hat Enterprise Linux 7.
- ImageMagick-0:6.9.10.68-17.el7_9
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- ImageMagick-0:6.9.10.68-17.el7_9
- RHSA-2026:32961
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Restrict ImageMagick processing capabilities via policy.xml, disabling the SVG coder and restricting delegates to prevent injection escalation to OS command execution. Enforce mandatory access control (SELinux/AppArmor) combined with seccomp syscall filtering to block execve. For systemd services, enable NoNewPrivileges, ProtectSystem=strict, ProtectHome=true, and PrivateDevices=true.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.