ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
Summary
Using Magick to read a malicious SVG file resulted in a DoS attack.
Details
bt obtained using gdb:
#4 0x0000555555794c9c in ResizeMagickMemory (memory=0x7fffee203800, size=391344) at MagickCore/memory.c:1443
#5 0x0000555555794e5a in ResizeQuantumMemory (memory=0x7fffee203800, count=48918, quantum=8)
at MagickCore/memory.c:1508
#6 0x0000555555acc8ed in SVGStartElement (context=0x517000000080, name=0x5190000055e3 "g", attributes=0x0)
at coders/svg.c:1254
#7 0x00007ffff6799b1c in xmlParseStartTag () at /lib/x86_64-linux-gnu/libxml2.so.2
#8 0x00007ffff68c7bb8 in () at /lib/x86_64-linux-gnu/libxml2.so.2
#9 0x00007ffff67a03f1 in xmlParseChunk () at /lib/x86_64-linux-gnu/libxml2.so.2This is related to the SVGStartElement and ResizeQuantumMemory functions.
PoC
-
Generate an SVG file
-
Read this file using Magick:
./magick /data/ylwang/Tools/LargeScan/targets/ImageMagick/test++/1.svg null- Causes a DoS Attack
My server has a large amount of memory, causing a stack overflow to take a long time. I'll use the Windows release version as an example:
PS C:\Program Files\ImageMagick-7.1.2-Q8> .\magick.exe -ping 1.svg null:
PS C:\Program Files\ImageMagick-7.1.2-Q8> echo $LASTEXITCODE
-1073741571The error code -1073741571 indicates a crash due to a stack overflow.
Impact
This is a DoS vulnerability and all applications using Magick to parse SVG files are affected.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | Magick.NET-Q16-AnyCPU | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-arm64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-AnyCPU | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-arm64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-OpenMP-arm64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-OpenMP-x64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-x64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-HDRI-x86 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-OpenMP-arm64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-OpenMP-x64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-x64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q16-x86 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q8-AnyCPU | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q8-arm64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q8-OpenMP-arm64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q8-OpenMP-x64 | < 14.10.1 | 14.10.1 |
| .NET (NuGet) | Magick.NET-Q8-x86 | < 14.10.1 | 14.10.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L- Weakness (CWE)
CWE-674- Platform
- .NET (NuGet)
- Package
Magick.NET-Q16-AnyCPU, Magick.NET-Q16-arm64, Magick.NET-Q16-HDRI-AnyCPU- Disclosed
- 30.12.2025
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-p27m-hp98-6637 - CC BY 4.0
Vulnerability history: Magick.NET-Q16-HDRI-x86
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 163
- First → latest
- 07.2025 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 26
- Medium 98
- Low 39
Disclosures per year
- 2025: 15
- 2026: 148
-
ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.