CVE-2026-123273 · Package
NO FIX YET · SEE WHAT TO DO
ImageMagick's SVG decoder fails to validate the width and height of a requested pixel region, so a crafted SVG can keep it looping. An attacker who gets a malicious SVG processed consumes CPU and hangs the decoding worker, which is a denial of service.
first public Nov 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems that run ImageMagick below the fixed versions and decode SVG files, especially those that accept uploads or generate thumbnails from user-supplied images. Installations that never process SVG input, or that run only trusted content, are less exposed. The sources do not describe a default-configuration exposure.
Not affected if no-svg-input, patched-version
Who cares image-processing, imagemagick, self-hosted, svg
magick -version or convert -version and compare against the fixed versions.7.1.2-356.9.13-60ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.