Infinite Loop Vulnerability in ImageMagick's SVG Decoder
CVE-2026-123273

7.1HIGH

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123273?

An infinite loop vulnerability exists in the SVG decoder of ImageMagick versions prior to 7.1.2-35 and 6.9.13-60. This vulnerability arises when the QueueAuthenticPixelCacheNexus function in MagickCore's cache.c fails to properly validate the requested width and height of a pixel region. Attackers can exploit this flaw by submitting a specially crafted SVG image that requests a pixel region without making progress, leading to excessive CPU usage and causing the decoding worker to hang indefinitely.

Affected Version(s)

ImageMagick 7.0.0 < 7.1.2-35

ImageMagick 0 < 6.9.13-60

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://github.com/ImageMagick/ImageMagick/commit/c5f2c6c...
patch
https://github.com/ImageMagick/ImageMagick6/commit/712e52...
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Santiko Kusnul Hakim
dlemstra
.