CVE-2025-68618
Unknown Unknown - Not Provided
Denial of Service in ImageMagick SVG Parsing Before

Publication date: 2025-12-30

Last updated on: 2025-12-30

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-30
Last Modified
2025-12-30
Generated
2026-06-16
AI Q&A
2025-12-30
EPSS Evaluated
2026-06-15
NVD
CVE-2025-68618
EUVD
EUVD-2025-205813
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
imagemagick imagemagick *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in ImageMagick occurs when the software reads a malicious SVG file, which can cause a Denial of Service (DoS) attack. It affects versions prior to 7.1.2-12, and the issue is fixed in version 7.1.2-12.

Compliance Impact

This vulnerability causes a denial-of-service (DoS) by crashing the ImageMagick application when processing malicious SVG files, but it does not impact confidentiality or integrity of data. Therefore, it does not directly affect compliance with standards like GDPR or HIPAA, which focus on data protection and privacy. However, availability is impacted, which could indirectly affect compliance if the service relying on ImageMagick is critical for regulatory requirements. No explicit information on compliance impact is provided. [2]

Detection Guidance

This vulnerability can be detected by testing the ImageMagick installation with a specially crafted malicious SVG file that triggers excessive recursion and causes a denial-of-service (DoS) crash. Using the Magick command-line tool to read such a crafted SVG file can reveal if the system is vulnerable, as it will crash or exhibit stack overflow behavior. For example, you can run a command like `magick identify malicious.svg` or `magick convert malicious.svg output.png` where `malicious.svg` is a crafted SVG file designed to exploit the uncontrolled recursion. Monitoring for crashes or error codes such as -1073741571 (on Windows) during these operations indicates the presence of the vulnerability. Additionally, checking the installed ImageMagick version to ensure it is 7.1.2-12 or later can help confirm if the system is patched. [2]

Impact Analysis

The vulnerability can cause a Denial of Service (DoS) attack, potentially making the ImageMagick service unavailable or unresponsive when processing malicious SVG files.

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-12 or later to fix the denial of service vulnerability caused by processing malicious SVG files.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart