4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68950

CVE-2025-68950: Magick's failure to limit MVG mutual references forming a loop

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68950

CVE-2025-68950:

4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q16-x86	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-AnyCPU	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-arm64	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-x64	nuget	< 14.10.1	14.10.1
Magick.NET-Q8-x86	nuget	< 14.10.1	14.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stack overflow in ImageMagick caused by uncontrolled recursion when processing a malicious MVG (Magick Vector Graphics) file. The core of the issue lies in the DrawPrimitive function in MagickCore/draw.c. When parsing an MVG file, this function could be manipulated to load another MVG file, which in turn could reference the original file, creating a circular dependency and an infinite recursive loop. The provided stack trace clearly shows this recursive pattern with repeated calls to ReadMVGImage, DrawImage, RenderMVGContent, and DrawPrimitive. The fix, implemented in commit 204718c2211903949dcfc0df8e65ed066b008dec, addresses this by adding a condition within DrawPrimitive to explicitly prevent the loading of another MVG file if the current context is already processing one. This simple check effectively breaks the cycle and prevents the stack overflow. Therefore, DrawPrimitive is the primary vulnerable function, and ReadMVGImage is also a critical function in the execution path that triggers the vulnerability.

Vulnerable functions

DrawPrimitive

MagickCore/draw.c

The `DrawPrimitive` function is vulnerable to a stack overflow. When processing an MVG file, it can be tricked into recursively loading another MVG file, leading to uncontrolled recursion. The patch prevents this by adding a check to disallow the processing of nested MVG files, thus breaking the recursive loop.

ReadMVGImage

coders/mvg.c

The `ReadMVGImage` function is the initial function that starts the processing of the MVG file. It calls other functions that eventually lead to the recursive call to `DrawPrimitive`. While the fix is in `DrawPrimitive`, `ReadMVGImage` is a key part of the vulnerable execution flow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.