CVE-2026-123273
Awaiting Analysis Awaiting Analysis - Queue

Infinite Loop in ImageMagick SVG Decoder

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123273
EUVD
EUVD-2026-117726

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an infinite loop flaw in ImageMagick's SVG decoder. The issue occurs in the QueueAuthenticPixelCacheNexus function in MagickCore/cache.c. Attackers can exploit it by providing a maliciously crafted SVG image that requests a non-advancing pixel region repeatedly. This causes the decoding process to hang indefinitely, consuming excessive CPU resources and making the system unresponsive.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or identify --version. If the version is below 7.1.2-35 or 6.9.13-60, the system is vulnerable. Additionally, monitor for unusual CPU usage spikes when processing SVG files, as this may indicate an infinite loop attack.

Impact Analysis

This vulnerability can lead to denial of service by causing system hangs or crashes. It consumes excessive CPU resources, making applications or systems unresponsive. If exploited in a server environment, it could disrupt services and require manual intervention to recover.

Mitigation Strategies

Immediately upgrade ImageMagick to version 7.1.2-35 or later for ImageMagick 7, or 6.9.13-60 or later for ImageMagick 6. Disable SVG processing if not required, or restrict access to trusted sources. Apply patches from official ImageMagick releases to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...