CVE-2026-123273: ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder
ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using affected ImageMagick releases that decode SVG images are exposed. The listed affected versions are releases before 7.1.2-35 and before 6.9.13-60.
What does an attacker need to exploit it?
An attacker needs the ability to provide a crafted SVG image to an ImageMagick decoding workflow. The vector is network-accessible and requires low privileges, with no user interaction indicated.
What is the impact of successful exploitation?
The crafted SVG can cause the decoding worker to enter an infinite loop, consume CPU, and hang. The supplied scoring indicates an availability impact only, with no confidentiality or integrity impact.
What can be done if patching is not immediately possible?
The provided data does not identify a vendor workaround. As an operational mitigation, avoid decoding untrusted SVG files until affected ImageMagick versions can be updated.