Description

ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T19:17:20.903Z",
  "pubdate": "2026-11-05T19:17:20.903Z",
  "executiveSummary": "An infinite loop vulnerability exists within the ImageMagick SVG decoder, specifically impacting versions prior to 7.1.2-35 and 6.9.13-60.\nThe vulnerability originates from a failure to perform adequate input validation on pixel region dimensions during the rendering process.\nAn unauthenticated attacker can exploit this flaw by submitting a maliciously crafted SVG file designed to trigger the identified logic error.\nSuccessful exploitation results in a Denial of Service (DoS) condition, as the targeted decoding worker enters an infinite loop, leading to uncontrolled CPU resource exhaustion and complete degradation of the process.\nThis vulnerability is critical in environments where ImageMagick is utilized to process user-supplied SVG imagery, as it requires no prior authentication or elevated privileges to execute.\nImpact is primarily focused on system availability; however, the persistent consumption of computing resources could potentially facilitate broader service outages in multi-tenant environments.",
  "technicalDetails": "The vulnerability resides within the MagickCore/cache.c source file, specifically affecting the QueueAuthenticPixelCacheNexus function. This function is responsible for preparing and managing the authentic pixel cache nexus during the image decoding pipeline. The root cause is a deficiency in input sanitization: the decoder fails to validate the width and height parameters of the requested pixel regions when parsing Scalable Vector Graphics (SVG) inputs.\nIn the context of the SVG decoder, the rendering engine requests segments of the pixel cache to represent the vector graphic in raster format. By providing crafted SVG instructions, an attacker can manipulate the internal state such that the decoder continuously requests a non-advancing pixel region. Because the logic within QueueAuthenticPixelCacheNexus does not enforce strict bounds checks or detect that the coordinate pointers remain stationary, the processing loop enters a permanent state of execution.\nThe attack flow begins when the ImageMagick library attempts to load and interpret a maliciously structured SVG file. As the SVG parser initializes the rendering process, it triggers the vulnerable code path. The decoder attempts to allocate or access the pixel cache nexus based on the user-provided parameters. Since these dimensions do not advance or validate against expected constraints, the application enters a recursive or repetitive loop within the decoding worker. This worker thread remains locked in this execution state indefinitely, consuming 100% of the assigned CPU core.\nBecause this process occurs during the early stages of image decoding, it does not require complex payloads or multi-stage exploitation. An attacker simply needs to upload or supply the image to a publicly accessible endpoint or application service that utilizes ImageMagick for image processing. The vulnerability is triggered automatically upon the library's attempt to render the image. No authentication is necessary, and the attacker does not require any specific privilege level, making the attack surface the ImageMagick library itself. The post-exploitation impact is a stable DoS, which is difficult to mitigate without terminating the worker process, potentially causing cascading failures in dependent services."
}