Skip to content
fr Sign in
7.1 High

CVE-2026-123273 ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder

Description

ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
Low
Interaction
None
Confidentiality
None
Integrity
None
Availability
High
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
ImageMagick 7.0 7.0.0 → < 7.1.2-35 7.1.2-35
ImageMagick 6.9 earliest → < 6.9.13-60 6.9.13-60

References

Timeline

  1. Published
  2. Last modified

Other CVEs of ImageMagick

The 276 CVEs of ImageMagick →
CVE-2026-119124 ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause… 4.8 Medium CVE-2026-119123 ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder 6.3 Medium CVE-2026-116160 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate 4.8 Medium CVE-2026-116158 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup… 2.0 Low
Track this CVE