CVE-2025-68950
published 2025-12-30CVE-2025-68950: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular…
PriorityP427medium6.2CVSS 3.1
AVLACLPRNUINSUCNINAH
EPSS
0.16%
6.0th percentile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (bookworm) |
| imagemagick | imagemagick | < 7.1.2-12 | 7.1.2-12 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u8 | 8:6.9.11.60+dfsg-1.3+deb11u8 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u5 | 8:6.9.11.60+dfsg-1.6+deb12u5 |
| imagemagick | imagemagick | >= 0 < 8:7.1.1.43+dfsg1-1+deb13u4 | 8:7.1.1.43+dfsg1-1+deb13u4 |
| imagemagick | imagemagick | >= 0 < 8:7.1.2.12+dfsg1-1 | 8:7.1.2.12+dfsg1-1 |
| ubuntu | imagemagick | — | — |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv6.2MEDIUM
vendor_ubuntu6.2MEDIUM
vendor_debian4.0MEDIUM
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-68950: ImageMagick is free and open-source software used for editing and manipulating digital images
osv·2025-12-30·CVSS 6.2
CVE-2025-68950 [MEDIUM] CVE-2025-68950: ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.
OSV
ImageMagick's failure to limit MVG mutual causes Stack Overflow
osv·2025-12-30
CVE-2025-68950 [MEDIUM] ImageMagick's failure to limit MVG mutual causes Stack Overflow
ImageMagick's failure to limit MVG mutual causes Stack Overflow
### Summary
Magick fails to check for circular references between two MVGs, leading to a stack overflow.
### Details
After reading mvg1 using Magick, the following is displayed:
```
./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png
AddressSanitizer:DEADLYSIGNAL
==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)
#0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726
#1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261
#2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368
#3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311
#4 0x558954
GHSA
ImageMagick's failure to limit MVG mutual causes Stack Overflow
ghsa·2025-12-30
CVE-2025-68950 [MEDIUM] CWE-674 ImageMagick's failure to limit MVG mutual causes Stack Overflow
ImageMagick's failure to limit MVG mutual causes Stack Overflow
### Summary
Magick fails to check for circular references between two MVGs, leading to a stack overflow.
### Details
After reading mvg1 using Magick, the following is displayed:
```
./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png
AddressSanitizer:DEADLYSIGNAL
==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)
#0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726
#1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261
#2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368
#3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311
#4 0x558954
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 6.2
CVE-2026-33905 [MEDIUM] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick did not limit mutual references between
MVG files. An attacker could possibly use this issue to cause a stack
overflow, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-68950)
It was discovered that the ImageMagick MSL coder destroyed a cloned image
twice when an MSL script failed. An attacker could possibly use this issue
to cause a use-after-free, resulting in a denial of service, or arbitrary
code execution. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and U
Red Hat
ImageMagick: ImageMagick: Denial of Service via circular references in MVG files
vendor_redhat·2025-12-30·CVSS 4.0
CVE-2025-68950 [MEDIUM] CWE-674 ImageMagick: ImageMagick: Denial of Service via circular references in MVG files
ImageMagick: ImageMagick: Denial of Service via circular references in MVG files
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.
A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. ImageMagick fails to check for circular references between two Magick Vector Graphics (MVG) files. A remote attacker could exploit this by providing a specially crafted MVG file, leading to a stack overflow and causing a Denial of Service (DoS) condition.
Debian
CVE-2025-68950: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
vendor_debian·2025·CVSS 4.0
CVE-2025-68950 [MEDIUM] CVE-2025-68950: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d...
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u5)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u8)
forky: resolved (fixed in 8:7.1.2.12+dfsg1-1)
sid: resolved (fixed in 8:7.1.2.12+dfsg1-1)
trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u4)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-68950 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.0
CVE-2025-68950 [MEDIUM] CVE-2025-68950 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68950 :
C# vulnerability analysis and mitigation
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.
Source : NVD
## 6.2
Score
Published December 30, 2025
Severity MEDIUM
CNA Score 4.0
Affected Technologies
C#
ImageMagick
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
ImageMagick-devel
Magick.NET-Q8-x86
Sou
Bugzilla
CVE-2025-68950 ImageMagick: ImageMagick: Denial of Service via circular references in MVG files [fedora-42]
bugzilla·2026-01-01·CVSS 6.2
CVE-2025-68950 [MEDIUM] CVE-2025-68950 ImageMagick: ImageMagick: Denial of Service via circular references in MVG files [fedora-42]
CVE-2025-68950 ImageMagick: ImageMagick: Denial of Service via circular references in MVG files [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's poli
2025-12-30
Published