Magick's failure to limit the depth of SVG file reads caused a DoS attack.

Vulnerability

Overview

ImageMagick versions prior to 7.1.2-12 contain a denial-of-service (DoS) vulnerability in the SVG parsing code. The root cause is the absence of a recursion-depth check when processing nested SVG elements. The SVGStartElement and MSLStartElement functions recursively` call themselves without limiting the nesting depth, leading to uncontrolled stack growth when a malicious SVG file with deeply nested elements is parsed [1][2][3].

Exploitation

An attacker can exploit this vulnerability by crafting a specially designed SVG file that contains an excessive number of nested elements (e.g., ` tags). When ImageMagick reads this file using any of its tools or APIs (such as magick or convert`), the recursive parsing exhausts the call stack, causing a crash. No authentication or special privileges are required; the attack vector is local or remote if the application processes user-supplied SVG files [4].

Impact

Successful exploitation results in a denial of service. The application crashes with a stack overflow (e.g., exit code -1073741571 on Windows). This affects all applications that use ImageMagick to parse SVG files, including web services, image processing pipelines, and desktop tools [4].

Mitigation

The vulnerability is fixed in ImageMagick version 7.1.2-12. The patch introduces a depth counter and a check against MagickMaxRecursionDepth in both MSLStartElement and SVGStartElement, stopping parsing when the limit is exceeded [3]. Users should upgrade to the patched version or apply the commit 6f431d445f3ddd609c004a1dde617b0a73e60beb. No workaround is available other than avoiding processing untrusted SVG files [2][4].