{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123273", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T18:19:13.027Z", "datePublished": "2026-11-05T18:45:36.913Z", "dateUpdated": "2026-11-05T18:45:36.913Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:45:36.913Z"}, "datePublic": "2026-11-01T00:00:00.000Z", "title": "ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder", "descriptions": [{"lang": "en", "value": "ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')", "cweId": "CWE-835", "type": "CWE"}]}], "affected": [{"vendor": "ImageMagick", "product": "ImageMagick", "defaultStatus": "unaffected", "versions": [{"version": "7.0.0", "lessThan": "7.1.2-35", "status": "affected", "versionType": "custom"}, {"version": "0", "lessThan": "6.9.13-60", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:github/imagemagick/imagemagick", "repo": "https://github.com/ImageMagick/ImageMagick"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.1.2-35"}, {"vulnerable": true, "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.9.13-60"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q66g-3m63-78mh", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-q66g-3m63-78mh)"}, {"url": "https://github.com/ImageMagick/ImageMagick/commit/c5f2c6c9fb1458f960a506691c9351e9da6d2247", "tags": ["patch"]}, {"url": "https://github.com/ImageMagick/ImageMagick6/commit/712e523e7f746d35c963b78555e1c24364a9426e", "tags": ["patch"]}, {"url": "https://github.com/ImageMagick/ImageMagick/blob/3a9639c0bd21f61f22fcce4c5f6838f1f0d8f738/MagickCore/cache.c#L4348", "tags": ["technical-description"]}, {"url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-35", "tags": ["release-notes"], "name": "ImageMagick 7.1.2-35 Release Notes"}, {"url": "https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-60", "tags": ["release-notes"], "name": "ImageMagick 6.9.13-60 Release Notes"}, {"name": "VulnCheck Advisory: ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-35-and-6.9.13-60-infinite-loop-via-svg-decoder"}], "credits": [{"lang": "en", "value": "Santiko Kusnul Hakim", "type": "finder"}, {"lang": "en", "value": "dlemstra", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/imagemagick/imagemagick", "product": "ImageMagick", "repo": "https://github.com/ImageMagick/ImageMagick", "vendor": "ImageMagick", "versions": [{"lessThan": "7.1.2-35", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "6.9.13-60", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker."}], "id": "CVE-2026-123273", "lastModified": "2026-11-05T19:17:21.047", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T19:17:20.903", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/ImageMagick/ImageMagick/blob/3a9639c0bd21f61f22fcce4c5f6838f1f0d8f738/MagickCore/cache.c#L4348"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ImageMagick/ImageMagick/commit/c5f2c6c9fb1458f960a506691c9351e9da6d2247"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-35"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q66g-3m63-78mh"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ImageMagick/ImageMagick6/commit/712e523e7f746d35c963b78555e1c24364a9426e"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-60"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-35-and-6.9.13-60-infinite-loop-via-svg-decoder"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "ImageMagick: ImageMagick: Denial of Service via infinite loop in SVG decoding", "id": "2567639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567639"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in ImageMagick. An attacker can cause a Denial of Service (DoS) by submitting a specially crafted Scalable Vector Graphics (SVG) image. Due to improper validation of pixel cache dimensions during decoding, the application enters an infinite loop while processing the image. This behavior exhausts CPU resources and hangs the image decoding worker."], "mitigation": {"lang": "en:us", "value": "Disable SVG decoding within the ImageMagick security policy configuration.\nEdit `/etc/ImageMagick-6/policy.xml` (or `/etc/ImageMagick-7/policy.xml`, depending on the installed version) and add the following line inside the `<policymap>` element:\n```xml\n<policy domain=\"coder\" rights=\"none\" pattern=\"SVG\" />\n```\nCaveats:\nDisabling this coder prevents ImageMagick from reading, converting, or rendering any SVG files. Applications requiring SVG conversion will fail to process those files.\nWarning:\nIf ImageMagick is invoked by persistent background services, daemons, or web application servers, those dependent services must be restarted or reloaded for the policy changes to take effect."}, "name": "CVE-2026-123273", "package_state": [{"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Under investigation", "package_name": "ImageMagick", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Under investigation", "package_name": "ImageMagick", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2026-11-05T18:45:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123273\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123273\nhttps://github.com/ImageMagick/ImageMagick/blob/3a9639c0bd21f61f22fcce4c5f6838f1f0d8f738/MagickCore/cache.c#L4348\nhttps://github.com/ImageMagick/ImageMagick/commit/c5f2c6c9fb1458f960a506691c9351e9da6d2247\nhttps://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-35\nhttps://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q66g-3m63-78mh\nhttps://github.com/ImageMagick/ImageMagick6/commit/712e523e7f746d35c963b78555e1c24364a9426e\nhttps://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-60\nhttps://www.vulncheck.com/advisories/imagemagick-before-7.1.2-35-and-6.9.13-60-infinite-loop-via-svg-decoder"], "statement": "This vulnerability is rated as Moderate severity because it is limited to a denial of service condition without compromising system confidentiality or data integrity. In typical Red Hat deployments, ImageMagick operates as a backend library or command-line utility, exposing environments to risk only when applications accept and process untrusted vector graphics. While an exploit can exhaust CPU resources and cause decoding worker processes to hang, it does not allow memory corruption or arbitrary code execution.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.1.2-35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.9.13-60)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "ImageMagick", "source": "cna", "vendor": "ImageMagick"}, "product": "imagemagick", "vendor": "imagemagick"}], "created": "2026-11-05T20:45:07.262298+00:00", "updated": "2026-11-05T21:00:19.521315+00:00", "vendors": ["imagemagick", "imagemagick$PRODUCT$imagemagick"]}