CVE-2025-68618
published 2025-12-30CVE-2025-68618: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.55%
42.5th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) |
| imagemagick | imagemagick | < 7.1.2-12 | 7.1.2-12 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u8 | 8:6.9.11.60+dfsg-1.3+deb11u8 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u5 | 8:6.9.11.60+dfsg-1.6+deb12u5 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u4 | 8:7.1.1.43+dfsg1-1+deb13u4 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.12+dfsg1-1 | 8:7.1.2.12+dfsg1-1 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.13+esm17 | 8:6.7.7.10-6ubuntu3.13+esm17 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.16+esm16 | 8:6.8.9.9-7ubuntu5.16+esm16 |
| imagemagick | imagemagick | >= 0 < 8:6.9.7.4+dfsg-16ubuntu6.15+esm8 | 8:6.9.7.4+dfsg-16ubuntu6.15+esm8 |
| imagemagick | imagemagick | >= 0 < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm6 | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm6 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm6 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm6 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm5 | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
imagemagick vulnerabilities
osv·2026-02-03·CVSS 7.5
CVE-2025-43965 [HIGH] imagemagick vulnerabilities
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled image depth values
when processing MIFF image files. An attacker could use this issue to cause
a denial of service or possibly execute arbitrary code. (CVE-2025-43965)
It was discovered that ImageMagick incorrectly processed SVG images and
MSL files. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-68618)
It was discovered that ImageMagick incorrectly handled memory when
converting MVG files. An attacker could possibly use this issue to cause a
denial of service. (CVE-2025-69204)
OSV
CVE-2025-68618: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2025-12-30·CVSS 7.5
CVE-2025-68618 [HIGH] CVE-2025-68618: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
OSV
ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
osv·2025-12-30
CVE-2025-68618 [MEDIUM] ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
### Summary
Using Magick to read a malicious SVG file resulted in a DoS attack.
### Details
bt obtained using gdb:
```
#4 0x0000555555794c9c in ResizeMagickMemory (memory=0x7fffee203800, size=391344) at MagickCore/memory.c:1443
#5 0x0000555555794e5a in ResizeQuantumMemory (memory=0x7fffee203800, count=48918, quantum=8)
at MagickCore/memory.c:1508
#6 0x0000555555acc8ed in SVGStartElement (context=0x517000000080, name=0x5190000055e3 "g", attributes=0x0)
at coders/svg.c:1254
#7 0x00007ffff6799b1c in xmlParseStartTag () at /lib/x86_64-linux-gnu/libxml2.so.2
#8 0x00007ffff68c7bb8 in () at /lib/x86_64-linux-gnu/libxml2.so.2
#9 0x00007ffff67a03f1 in xmlParseChunk () at /lib/x86_64-linux-gnu/libxml2.so.2
```
This
GHSA
ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
ghsa·2025-12-30
CVE-2025-68618 [MEDIUM] CWE-674 ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
### Summary
Using Magick to read a malicious SVG file resulted in a DoS attack.
### Details
bt obtained using gdb:
```
#4 0x0000555555794c9c in ResizeMagickMemory (memory=0x7fffee203800, size=391344) at MagickCore/memory.c:1443
#5 0x0000555555794e5a in ResizeQuantumMemory (memory=0x7fffee203800, count=48918, quantum=8)
at MagickCore/memory.c:1508
#6 0x0000555555acc8ed in SVGStartElement (context=0x517000000080, name=0x5190000055e3 "g", attributes=0x0)
at coders/svg.c:1254
#7 0x00007ffff6799b1c in xmlParseStartTag () at /lib/x86_64-linux-gnu/libxml2.so.2
#8 0x00007ffff68c7bb8 in () at /lib/x86_64-linux-gnu/libxml2.so.2
#9 0x00007ffff67a03f1 in xmlParseChunk () at /lib/x86_64-linux-gnu/libxml2.so.2
```
This
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2026-02-03·CVSS 2.9
CVE-2025-68618 [LOW] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled image depth values
when processing MIFF image files. An attacker could use this issue to cause
a denial of service or possibly execute arbitrary code. (CVE-2025-43965)
It was discovered that ImageMagick incorrectly processed SVG images and
MSL files. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-68618)
It was discovered that ImageMagick incorrectly handled memory when
converting MVG files. An attacker could possibly use this issue to cause a
denial of service. (CVE-2025-69204)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ImageMagick: ImageMagick: Denial of Service via malicious SVG file
vendor_redhat·2025-12-30·CVSS 5.3
CVE-2025-68618 [MEDIUM] CWE-674 ImageMagick: ImageMagick: Denial of Service via malicious SVG file
ImageMagick: ImageMagick: Denial of Service via malicious SVG file
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. An attacker could exploit this vulnerability by providing a specially crafted malicious SVG (Scalable Vector Graphics) file. Processing this file would lead to a Denial of Service (DoS) attack, making the software unavailable to legitimate users.
Statement: This vulnerability is rated Moderate for Red Hat. A denial of service can occur in ImageMagick when processing a specially crafted mali
Debian
CVE-2025-68618: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2025·CVSS 5.3
CVE-2025-68618 [MEDIUM] CVE-2025-68618: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u5)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u8)
forky: resolved (fixed in 8:7.1.2.12+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.12+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u4)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-68618 ImageMagick: ImageMagick: Denial of Service via malicious SVG file [fedora-42]
bugzilla·2026-01-01·CVSS 7.5
CVE-2025-68618 [HIGH] CVE-2025-68618 ImageMagick: ImageMagick: Denial of Service via malicious SVG file [fedora-42]
CVE-2025-68618 ImageMagick: ImageMagick: Denial of Service via malicious SVG file [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close al
Wiz
CVE-2025-68618 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-68618 [MEDIUM] CVE-2025-68618 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68618 :
C# vulnerability analysis and mitigation
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
Source : NVD
## 7.5
Score
Published December 30, 2025
Severity HIGH
CNA Score 5.3
Affected Technologies
C#
ImageMagick
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 27.8
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
ImageMagick-config-7-upstream-websafe
perl-PerlMagick
Sources
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, edge Severity HIGH H
2025-12-30
Published