{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-123273","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","state":"PUBLISHED","assignerShortName":"VulnCheck","dateReserved":"2026-11-05T18:19:13.027Z","datePublished":"2026-11-05T18:45:36.913Z","dateUpdated":"2026-11-05T18:45:36.913Z"},"containers":{"cna":{"providerMetadata":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-11-05T18:45:36.913Z"},"datePublic":"2026-11-01T00:00:00.000Z","title":"ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder","descriptions":[{"lang":"en","value":"ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker."}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Loop with Unreachable Exit Condition ('Infinite Loop')","cweId":"CWE-835","type":"CWE"}]}],"affected":[{"vendor":"ImageMagick","product":"ImageMagick","defaultStatus":"unaffected","versions":[{"version":"7.0.0","lessThan":"7.1.2-35","status":"affected","versionType":"custom"},{"version":"0","lessThan":"6.9.13-60","status":"affected","versionType":"custom"}],"packageURL":"pkg:github/imagemagick/imagemagick","repo":"https://github.com/ImageMagick/ImageMagick"}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.1.2-35"},{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9.13-60"}]}]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q66g-3m63-78mh","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-q66g-3m63-78mh)"},{"url":"https://github.com/ImageMagick/ImageMagick/commit/c5f2c6c9fb1458f960a506691c9351e9da6d2247","tags":["patch"]},{"url":"https://github.com/ImageMagick/ImageMagick6/commit/712e523e7f746d35c963b78555e1c24364a9426e","tags":["patch"]},{"url":"https://github.com/ImageMagick/ImageMagick/blob/3a9639c0bd21f61f22fcce4c5f6838f1f0d8f738/MagickCore/cache.c#L4348","tags":["technical-description"]},{"url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-35","tags":["release-notes"],"name":"ImageMagick 7.1.2-35 Release Notes"},{"url":"https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-60","tags":["release-notes"],"name":"ImageMagick 6.9.13-60 Release Notes"},{"name":"VulnCheck Advisory: ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-35-and-6.9.13-60-infinite-loop-via-svg-decoder"}],"credits":[{"lang":"en","value":"Santiko Kusnul Hakim","type":"finder"},{"lang":"en","value":"dlemstra","type":"remediation developer"}],"x_generator":{"engine":"vulncheck-endgame"}}}}