5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68618

CVE-2025-68618: Magick's failure to limit the depth of SVG file reads caused a DoS attack.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68618

CVE-2025-68618:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-x86	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-AnyCPU	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-x86	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.1	14.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service caused by uncontrolled recursion when ImageMagick parses a specially crafted SVG file. The provided stack trace and the security advisory point to the SVGStartElement function as the culprit. Analysis of the patch commit 6f431d445f3ddd609c004a1dde617b0a73e60beb confirms this. The patch adds a depth check at the beginning of the SVGStartElement function in coders/svg.c. Before this change, there was no limit on how many nested SVG elements the function would process, allowing an attacker to create a file that would cause a stack overflow. The same commit also applies a similar fix to the MSLStartElement function in coders/msl.c, indicating that it was also vulnerable to the same type of attack. Therefore, both SVGStartElement and MSLStartElement are identified as the vulnerable functions.

Vulnerable functions

SVGStartElement

coders/svg.c

The function `SVGStartElement` is called to process elements in an SVG file. Prior to the patch, there was no limit on the recursion depth for nested elements. A malicious SVG with excessive nesting would cause this function to be called repeatedly, leading to a stack overflow and a Denial of Service. The patch introduces a depth check using `MagickMaxRecursionDepth` to prevent this.

MSLStartElement

coders/msl.c

Similar to the SVG vulnerability, the `MSLStartElement` function for processing MSL files also lacked a recursion depth check. The same commit that fixed the SVG issue also added a depth check here to prevent a similar DoS attack using malicious MSL files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.