CVE-2025-68618

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.

Summary

Using Magick to read a malicious SVG file resulted in a DoS attack.

Details

bt obtained using gdb:

#4 0x0000555555794c9c in ResizeMagickMemory (memory=0x7fffee203800, size=391344) at MagickCore/memory.c:1443
#5 0x0000555555794e5a in ResizeQuantumMemory (memory=0x7fffee203800, count=48918, quantum=8) 
at MagickCore/memory.c:1508
#6 0x0000555555acc8ed in SVGStartElement (context=0x517000000080, name=0x5190000055e3 "g", attributes=0x0) 
at coders/svg.c:1254
#7 0x00007ffff6799b1c in xmlParseStartTag () at /lib/x86_64-linux-gnu/libxml2.so.2
#8 0x00007ffff68c7bb8 in () at /lib/x86_64-linux-gnu/libxml2.so.2
#9 0x00007ffff67a03f1 in xmlParseChunk () at /lib/x86_64-linux-gnu/libxml2.so.2

This is related to the SVGStartElement and ResizeQuantumMemory functions.

PoC

1. Generate an SVG file

2. Read this file using Magick:

./magick /data/ylwang/Tools/LargeScan/targets/ImageMagick/test++/1.svg null

3. Causes a DoS Attack

My server has a large amount of memory, causing a stack overflow to take a long time. I'll use the Windows release version as an example:

PS C:\Program Files\ImageMagick-7.1.2-Q8> .\magick.exe -ping 1.svg null:
PS C:\Program Files\ImageMagick-7.1.2-Q8> echo $LASTEXITCODE
-1073741571

The error code -1073741571 indicates a crash due to a stack overflow.

Impact

This is a DoS vulnerability and all applications using Magick to parse SVG files are affected.

Summary

Using Magick to read a malicious SVG file resulted in a DoS attack.

Details

bt obtained using gdb:

#4 0x0000555555794c9c in ResizeMagickMemory (memory=0x7fffee203800, size=391344) at MagickCore/memory.c:1443
#5 0x0000555555794e5a in ResizeQuantumMemory (memory=0x7fffee203800, count=48918, quantum=8) 
at MagickCore/memory.c:1508
#6 0x0000555555acc8ed in SVGStartElement (context=0x517000000080, name=0x5190000055e3 "g", attributes=0x0) 
at coders/svg.c:1254
#7 0x00007ffff6799b1c in xmlParseStartTag () at /lib/x86_64-linux-gnu/libxml2.so.2
#8 0x00007ffff68c7bb8 in () at /lib/x86_64-linux-gnu/libxml2.so.2
#9 0x00007ffff67a03f1 in xmlParseChunk () at /lib/x86_64-linux-gnu/libxml2.so.2

This is related to the SVGStartElement and ResizeQuantumMemory functions.

PoC

1. Generate an SVG file

2. Read this file using Magick:

./magick /data/ylwang/Tools/LargeScan/targets/ImageMagick/test++/1.svg null

3. Causes a DoS Attack

My server has a large amount of memory, causing a stack overflow to take a long time. I'll use the Windows release version as an example:

PS C:\Program Files\ImageMagick-7.1.2-Q8> .\magick.exe -ping 1.svg null:
PS C:\Program Files\ImageMagick-7.1.2-Q8> echo $LASTEXITCODE
-1073741571

The error code -1073741571 indicates a crash due to a stack overflow.

Impact

This is a DoS vulnerability and all applications using Magick to parse SVG files are affected.

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-68618)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.(CVE-2025-68950)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-69204)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-68618)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.(CVE-2025-68950)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-69204)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-68618)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.(CVE-2025-68950)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-69204)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-68618)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.(CVE-2025-68950)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-69204)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-68618)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.(CVE-2025-68950)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-69204)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-68618)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.(CVE-2025-68950)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-69204)

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-68618)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.(CVE-2025-68950)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.(CVE-2025-69204)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.

• SECURITY UPDATE: Malicious SVG file resulted in a DoS attack
  • debian/patches/CVE-2025-68618.patch: fix DOS when processing a specially crafted malicious SVG file
  • CVE-2025-68618
• SECURITY UPDATE: WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow and trigger a DoS attack
  • debian/patches/CVE-2025-69204.patch: fix DOS due to integer overflow during image processing of a specially crafted SVG image
  • CVE-2025-69204

• SECURITY UPDATE: Malicious SVG file resulted in a DoS attack
  • debian/patches/CVE-2025-68618.patch: fix DOS when processing a specially crafted malicious SVG file
  • CVE-2025-68618
• SECURITY UPDATE: WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow and trigger a DoS attack
  • debian/patches/CVE-2025-69204.patch: fix DOS due to integer overflow during image processing of a specially crafted SVG image
  • CVE-2025-69204

• CVE-2025-68618: fix DOS when processing a specially crafted malicious SVG file
• CVE-2025-69204: fix DOS due to buffer overflow during image processing of a specially crafted SVG image

• CVE-2025-68618: fix DOS when processing a specially crafted malicious SVG file
• CVE-2025-69204: fix DOS due to buffer overflow during image processing of a specially crafted SVG image

• CVE-2025-68618: added recursion depth check in MSL and SVG coders
• Check that image exists before we destroy it

• CVE-2025-68618: added recursion depth check in MSL and SVG coders
• Check that image exists before we destroy it

• SECURITY UPDATE: fix vulnerability in stream handling
  • debian/patches/CVE-2025-53019.patch: fix vulnerability in stream handling
  • CVE-2025-53019
• SECURITY UPDATE: fix integer overflow in resize
  • debian/patches/CVE-2025-55212.patch: fix integer overflow in resize
  • CVE-2025-55212
• SECURITY UPDATE: fix heap-based buffer overflow in image processing
  • debian/patches/CVE-2025-55298.patch: fix heap-based buffer overflow in image processing
  • CVE-2025-55298
• SECURITY UPDATE: fix buffer overflow in BMP coder
  • debian/patches/CVE-2025-57803.patch: fix buffer overflow in BMP coder
  • CVE-2025-57803
• SECURITY UPDATE: fix vulnerability in PNG coder
  • debian/patches/CVE-2025-55154.patch: fix vulnerability in PNG coder
  • CVE-2025-55154
• SECURITY UPDATE: fix buffer overflow in BMP coder on 32-bit systems
  • debian/patches/CVE-2025-62171.patch: fix buffer overflow in BMP coder on 32-bit systems
  • CVE-2025-62171
• SECURITY UPDATE: fix stack overflow via infinite recursion in MSL and SVG coders
  • debian/patches/CVE-2025-68618.patch: fix stack overflow via infinite recursion in MSL and SVG coders
  • CVE-2025-68618
• SECURITY UPDATE: fix denial of service in SVG coder
  • debian/patches/CVE-2025-69204.patch: fix denial of service in SVG coder
  • CVE-2025-69204

These are all security issues fixed in the ImageMagick-7.1.2.12-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues:

• CVE-2025-65955: Fixed use-after-free/double-free in ImageMagick (bsc#1254435)
• CVE-2025-66628: Fixed Integer Overflow leading to out of bounds read in ImageMagick (32-bit only) (bsc#1254820)
• CVE-2025-68618: Fixed that reading a malicious SVG file may result in a DoS attack (bsc#1255821)
• CVE-2025-68950: Fixed check for circular references in mvg files may lead to stack overflow (bsc#1255822)
• CVE-2025-69204: Fixed an integer overflow can lead to a DoS attack (bsc#1255823)

This update for ImageMagick fixes the following issues:

• CVE-2025-68618: read a malicious SVG file may result in a DoS attack (bsc#1255821).
• CVE-2025-68950: check for circular references in mvg files may lead to stack overflow (bsc#1255822).
• CVE-2025-69204: an integer overflow can lead to a DoS attack (bsc#1255823).

This update for ImageMagick fixes the following issues:

• CVE-2025-68618: read a malicious SVG file may result in a DoS attack (bsc#1255821).
• CVE-2025-68950: check for circular references in mvg files may lead to stack overflow (bsc#1255822).

This update for ImageMagick fixes the following issues:

• CVE-2025-68618: read a malicious SVG file may result in a DoS attack (bsc#1255821).
• CVE-2025-68950: check for circular references in mvg files may lead to stack overflow (bsc#1255822).
• CVE-2025-69204: an integer overflow can lead to a DoS attack (bsc#1255823).

This update for ImageMagick fixes the following issues:

• CVE-2025-68618: read a malicious SVG file may result in a DoS attack (bsc#1255821).

This update for ImageMagick fixes the following issues:

• CVE-2025-65955: Fixed use-after-free/double-free in ImageMagick (bsc#1254435)
• CVE-2025-66628: Fixed Integer Overflow leading to out of bounds read in ImageMagick (32-bit only) (bsc#1254820)
• CVE-2025-68618: Fixed that reading a malicious SVG file may result in a DoS attack (bsc#1255821)
• CVE-2025-68950: Fixed check for circular references in mvg files may lead to stack overflow (bsc#1255822)
• CVE-2025-69204: Fixed an integer overflow can lead to a DoS attack (bsc#1255823)