DEBIAN-CVE-2026-123273: Debian/imagemagick vulnerability

Published Nov 5, 2026

Updated

ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.

Affected Software

3 affected components

debian/imagemagick*

Event History

Nov 5, 2026

CVE Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which ImageMagick versions are affected?

The vulnerability affects ImageMagick versions before 7.1.2-35 and before 6.9.13-60.

What must an attacker provide to trigger the issue?

An attacker needs to supply a crafted SVG image that is processed by the ImageMagick SVG decoder.

What is the practical impact of successful exploitation?

The crafted SVG can cause a non-advancing pixel-region request, leading the decoding worker to consume CPU and hang.

DEBIAN-CVE-2026-123273: Debian/imagemagick vulnerability

Affected Software

Event History

Frequently Asked Questions

Which ImageMagick versions are affected?

What must an attacker provide to trigger the issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which ImageMagick versions are affected?

What must an attacker provide to trigger the issue?

What is the practical impact of successful exploitation?