Magick's failure to limit MVG mutual references forming a loop

Vulnerability

Overview

CVE-2025-68950 is a denial-of-service (DoS) vulnerability in ImageMagick, a widely used open-source image processing suite. Prior to version 7.1.2-12, the software does not validate for circular references between two Magick Vector Graphics (MVG) files. When processing a crafted MVG file that references another MVG which in turn references the first, the recursive parsing leads to unbounded recursion and ultimately a stack overflow [2][3].

Exploitation and

Attack Surface

The vulnerability is triggered by simply reading a specially crafted MVG file (e.g., via the magick command or any application that uses ImageMagick to process MVG content). The crash observed in the advisory shows a deep call chain running from ReadMVGImage into RenderMVGContent and DrawPrimitive, eventually causing a signal failure [3]. No authentication or special privileges are required; any scenario where an attacker can supply an MVG file for processing is affected [1][2].

Impact

An attacker can cause ImageMagick to crash via a stack overflow, leading to a denial of service. The vulnerability does not appear to enable arbitrary code execution or data leakage; its impact is strictly availability [3].

Mitigation

The issue is fixed in ImageMagick version 7.1.2-12. The commit adds a check to avoid processing MVG references in DrawPrimitive, preventing the circular reference loop [4]. Users should upgrade to the patched version or apply the provided commit. No workarounds are documented [2].