---
id: "CVE-2026-123273"
kind: "vulnerability"
aliases: ["CVE-2026-123273"]
title: "ImageMagick: crafted SVG file makes image decoding hang forever"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["image-processing", "imagemagick", "package", "self-hosted", "svg"]
not_affected_if: ["no-svg-input", "patched-version"]
published_at: "2026-11-05T19:17:20+00:00"
first_seen_at: "2026-11-05T19:40:37+00:00"
updated_at: "2026-11-05T19:43:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123273", "first_seen_at": "2026-11-05T19:40:37+00:00"}]
exploit_sources: []
---

# ImageMagick: crafted SVG file makes image decoding hang forever

ImageMagick's SVG decoder fails to validate the width and height of a requested pixel region, so a crafted SVG can keep it looping. An attacker who gets a malicious SVG processed consumes CPU and hangs the decoding worker, which is a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `magick -version` or `convert -version` and compare against the fixed versions.
- Check whether SVG input from untrusted users is passed to ImageMagick, for example in upload or thumbnail pipelines.

## Fix

- ImageMagick 7 branch: `7.1.2-35`
- ImageMagick 6 branch: `6.9.13-60`

## Timeline

- 2026-11-05T19:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123273

## Documents

- [advisory] Vendor advisory: github.com https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q66g-3m63-78mh
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-35-and-6.9.13-60-infinite-loop-via-svg-decoder
- [fix] Patch: github.com https://github.com/ImageMagick/ImageMagick/commit/c5f2c6c9fb1458f960a506691c9351e9da6d2247
- [fix] Release notes: github.com https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-35
- [fix] Patch: github.com https://github.com/ImageMagick/ImageMagick6/commit/712e523e7f746d35c963b78555e1c24364a9426e
- [fix] Release notes: github.com https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-60

## From the sources

ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_