CVE-2025-68950

Magick fails to check for circular references between two MVGs, leading to a stack overflow.

Details

After reading mvg1 using Magick, the following is displayed:

./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)
    #0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726
    #1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261
    #2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368
    #3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311
    #4 0x558954afb3a5 in DrawPolygonPrimitive._omp_fn.1 MagickCore/draw.c:5172
    #5 0x7f62dd89fa15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)
    #6 0x558954ae0f41 in DrawPolygonPrimitive MagickCore/draw.c:5156
    #7 0x558954ae5607 in DrawPrimitive MagickCore/draw.c:5875
    #8 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
    #9 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
    #10 0x55895496cedb in RenderFreetype MagickCore/annotate.c:2065
    #11 0x55895496702e in RenderType MagickCore/annotate.c:1112
    #12 0x558954963da7 in AnnotateImage MagickCore/annotate.c:544
    #13 0x558954ae4e0a in DrawPrimitive MagickCore/draw.c:5799
    #14 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
    #15 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
    #16 0x558954755a46 in ReadMVGImage coders/mvg.c:240
    #17 0x558954a15ecc in ReadImage MagickCore/constitute.c:743
    #18 0x558954ae3c76 in DrawPrimitive MagickCore/draw.c:5705
    #19 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
    #20 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
    #21 0x558954755a46 in ReadMVGImage coders/mvg.c:240
    ...

This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected.

CVE-2025-68950 has a CVSS score of 4.0 (Medium). The vector is requires local access, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (14.10.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2025-68950? CVE-2025-68950 is a medium-severity security vulnerability in Magick.NET-Q16-AnyCPU (nuget), affecting versions < 14.10.1. It is fixed in 14.10.1.
2. How severe is CVE-2025-68950? CVE-2025-68950 has a CVSS score of 4.0 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by CVE-2025-68950?
   • Magick.NET-Q16-AnyCPU (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-HDRI-AnyCPU (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-HDRI-OpenMP-arm64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-HDRI-OpenMP-x64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-HDRI-arm64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-HDRI-x64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-HDRI-x86 (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-OpenMP-arm64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-OpenMP-x64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-arm64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q16-x86 (nuget) (versions < 14.10.1)
   • Magick.NET-Q8-AnyCPU (nuget) (versions < 14.10.1)
   • Magick.NET-Q8-OpenMP-arm64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q8-OpenMP-x64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q8-arm64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q8-x64 (nuget) (versions < 14.10.1)
   • Magick.NET-Q8-x86 (nuget) (versions < 14.10.1)
4. Is there a fix for CVE-2025-68950? Yes. CVE-2025-68950 is fixed in 14.10.1. Upgrade to this version or later.
5. Is CVE-2025-68950 exploitable, and should I be worried? Whether CVE-2025-68950 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2025-68950 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2025-68950?
   • Upgrade Magick.NET-Q16-AnyCPU to 14.10.1 or later
   • Upgrade Magick.NET-Q16-HDRI-AnyCPU to 14.10.1 or later
   • Upgrade Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.1 or later
   • Upgrade Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.1 or later
   • Upgrade Magick.NET-Q16-HDRI-arm64 to 14.10.1 or later
   • Upgrade Magick.NET-Q16-HDRI-x64 to 14.10.1 or later
   • Upgrade Magick.NET-Q16-HDRI-x86 to 14.10.1 or later
   • Upgrade Magick.NET-Q16-OpenMP-arm64 to 14.10.1 or later
   • Upgrade Magick.NET-Q16-OpenMP-x64 to 14.10.1 or later
   • Upgrade Magick.NET-Q16-arm64 to 14.10.1 or later
   • Upgrade Magick.NET-Q16-x86 to 14.10.1 or later
   • Upgrade Magick.NET-Q8-AnyCPU to 14.10.1 or later
   • Upgrade Magick.NET-Q8-OpenMP-arm64 to 14.10.1 or later
   • Upgrade Magick.NET-Q8-OpenMP-x64 to 14.10.1 or later
   • Upgrade Magick.NET-Q8-arm64 to 14.10.1 or later
   • Upgrade Magick.NET-Q8-x64 to 14.10.1 or later
   • Upgrade Magick.NET-Q8-x86 to 14.10.1 or later