CVE-2026-123273 in ImageMagick
Summary
by MITRE • 11/05/2026
ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The identified vulnerability resides within the Scalable Vector Graphics (SVG) decoder of ImageMagick versions prior to 7.1.2-35 and 6.9.13-60. This flaw is specifically triggered by a failure in the QueueAuthenticPixelCacheNexus function located in the MagickCore/cache.c source file. The core technical deficiency involves an absence of validation for requested region width and height parameters during the processing of SVG images. When the decoder processes specific crafted inputs, it fails to ensure that pixel access operations result in forward progression through the image data structure. Instead, the logic allows for repeated requests targeting a non-advancing pixel region, creating a scenario where the decoding worker enters an infinite loop state rather than terminating or progressing normally.
From a technical perspective, this issue represents a classic resource exhaustion vulnerability stemming from improper input validation and control flow management. The attacker crafts an SVG image that exploits the logic error in QueueAuthenticPixelCacheNexus to force the decoder into a repetitive cycle of accessing the same pixel data without advancing the internal pointers or indices. This behavior prevents the function from completing its task, effectively trapping the execution thread within an endless loop. Because ImageMagick is often deployed as part of larger web applications and content management systems that process user-uploaded images, this vulnerability can be triggered remotely by submitting a malicious SVG file through any interface that invokes the image processing pipeline.
The operational impact of this vulnerability is primarily centered on denial of service conditions. By consuming excessive CPU resources indefinitely, the crafted SVG image causes the decoding worker thread to hang or become unresponsive. In environments where ImageMagick processes images concurrently for multiple users, such as web servers handling uploads or previews, a single malicious request can monopolize processing capacity. This leads to significant performance degradation for legitimate traffic and potentially complete service outages if enough threads are exhausted. The vulnerability does not typically allow for remote code execution in this specific context but serves as an effective vector for disrupting availability, which is critical for maintaining the integrity of services that rely on dynamic image manipulation.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-835, known as Loop with Unreachable Exit Condition Infinite Loop, and also relates to CWE-20 Improper Input Validation due to the lack of bounds checking on region dimensions. In terms of offensive security frameworks, this vulnerability maps to MITRE ATT&CK technique T1496 Resource Hijacking under the subtechnique of CPU Consumption, where adversaries use computational resources for denial-of-service purposes rather than data exfiltration or system control. Mitigation strategies require immediate upgrading ImageMagick to version 7.1.2-35 or later, and for legacy systems, patching to at least version 6.9.13-60. Additionally, organizations should implement input validation layers that restrict SVG processing to trusted sources only, utilize resource limits such as CPU time quotas on worker processes, and consider disabling the SVG delegate if it is not strictly required by their application workflow to reduce the attack surface entirely.