ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
Affected: NuGet: Magick.NET-Q16-AnyCPU, NuGet: Magick.NET-Q16-HDRI-AnyCPU, NuGet: Magick.NET-Q16-HDRI-x86, NuGet: Magick.NET-Q16-x86, NuGet: Magick.NET-Q8-AnyCPU, NuGet: Magick.NET-Q8-x86, NuGet: Magick.NET-Q8-arm64, NuGet: Magick.NET-Q8-OpenMP-x64, NuGet: Magick.NET-Q8-OpenMP-arm64, NuGet: Magick.NET-Q16-x64 and 7 more
### Summary
Using Magick to read a malicious SVG file resulted in a DoS attack.
### Details
bt obtained using gdb:
``` #4 0x0000555555794c9c in ResizeMagickMemory (memory=0x7fffee203800, size=391344) at MagickCore/memory.c:1443 #5 0x0000555555794e5a in ResizeQuantumMemory (memory=0x7fffee203800, count=48918, quantum=8) at MagickCore/memory.c:1508 #6 0x0000555555acc8ed in SVGStartElement (context=0x517000000080, name=0x5190000055e3 "g", attributes=0x0) at coders/svg.c:1254 #7 0x00007ffff6799b1c in xmlParseStartTag () at /lib/x86_64-linux-gnu/libxml2.so.2 #8 0x00007ffff68c7bb8 in () at /lib/x86_64-linux-gnu/libxml2.so.2 #9 0x00007ffff67a03f1 in xmlParseChunk () at /lib/x86_64-linux-gnu/libxml2.so.2 ```
This is related to the SVGStartElement and ResizeQuantumMemory functions.
### PoC
1. Generate an SVG file
2. Read this file using Magick:
``` ./magick /data/ylwang/Tools/LargeScan/targets/ImageMagick/test++/1.svg null ```
3. Causes a DoS Attack
My server has a large amount of memory, causing a stack overflow to take a long time. I'll use the Windows release version as an example:
``` PS C:\Program Files\ImageMagick-7.1.2-Q8> .\magick.exe -ping 1.svg null: PS C:\Program Files\ImageMagick-7.1.2-Q8> echo $LASTEXITCODE -1073741571 ```
The error code -1073741571 indicates a crash due to a stack overflow.
### Impact
This is a DoS vulnerability and all applications using Magick to parse SVG files are affected.
Affected: openEuler:20.03-LTS-SP4: ImageMagick
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es):
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-68618)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.(CVE-2025-68950)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-69204)
ImageMagick-7.1.2.12-1.1 on GA media
Security update for ImageMagick
Affected: Ubuntu:Pro:14.04:LTS: imagemagick, Ubuntu:Pro:16.04:LTS: imagemagick, Ubuntu:Pro:18.04:LTS: imagemagick, Ubuntu:Pro:20.04:LTS: imagemagick, Ubuntu:Pro:22.04:LTS: imagemagick, Ubuntu:Pro:24.04:LTS: imagemagick, Ubuntu:25.10: imagemagick
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
Ein Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um einen Denial of Service Angriff durchzuführen.