GHSA-q66g-3m63-78mh: ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder

Published Nov 5, 2026

Updated

ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.

Event History

Nov 5, 2026

CVE Published

via OSV·06:45 PM

Data Sourced

via OSV·06:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ImageMagick versions before 7.1.2-35 or 6.9.13-60 are affected when they decode SVG images. The impact is a decoding worker consuming CPU and hanging.

What does an attacker need to exploit the vulnerability?

An attacker needs the ability to provide a crafted SVG image to an affected ImageMagick instance for decoding. The supplied SVG triggers repeated requests for a non-advancing pixel region.

Is authentication or user interaction required?

The provided vector indicates low privileges are required and no user interaction is required. Exploitation depends on reaching an affected SVG-decoding workflow.

What should be done if an affected version is in use?

Upgrade ImageMagick to 7.1.2-35 or later, or 6.9.13-60 or later. The provided information does not specify an alternative mitigation for environments that cannot patch immediately.

GHSA-q66g-3m63-78mh: ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is authentication or user interaction required?

What should be done if an affected version is in use?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is authentication or user interaction required?

What should be done if an affected version is in use?