CVE-2026-123273— ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder

Quick assessment

Affected

ImageMagick ImageMagick

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ImageMagick 7.1.2-35 之前以及 6.9.13-60 之前的版本中，SVG 解码器存在一个无限循环漏洞。该漏洞源于中的函数未能对请求区域的宽度和高度进行验证。攻击者可构造特制的 SVG 图像，反复请求无法推进的像素区域，从而耗尽 CPU 资源并导致解码进程挂起。

CVSS 6.5 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

Vendor	Product	Version Range	Status
ImageMagick	ImageMagick	`7.0.0< 7.1.2-35`	affected
		`< 6.9.13-60`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder

Source: CVE Program / CVE List V5

Vulnerability Description

ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不可达退出条件的循环(无限循环)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ImageMagick	ImageMagick	7.0.0 ~ 7.1.2-35	-

II. Public POCs for CVE-2026-123273

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123273

请登录查看更多情报信息。

Other References for CVE-2026-123273 (7)

https://github.com/ImageMagick/ImageMagick6/commit/712e523e7f746d35c963b78555e1c24364a9426e patch
https://github.com/ImageMagick/ImageMagick/commit/c5f2c6c9fb1458f960a506691c9351e9da6d2247 patch
https://github.com/ImageMagick/ImageMagick/blob/3a9639c0bd21f61f22fcce4c5f6838f1f0d8f738/MagickCore/cache.c#L4348 technical-description
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-35 release-notes
https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-60 release-notes
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q66g-3m63-78mh vendor-advisory
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-35-and-6.9.13-60-infinite-loop-via-svg-decoder third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123273

IV. Related Vulnerabilities

Same product: ImageMagick

Same vendor: ImageMagick

Same weakness: CWE-835