CVE-2025-68950: ImageMagick MVG Circular Reference DoS

CVE-2025-68950 Overview

CVE-2025-68950 affects ImageMagick, an open-source image manipulation suite widely used in server-side rendering pipelines and desktop workflows. Versions prior to 7.1.2-12 fail to detect circular references between two Magick Vector Graphics (MVG) files. Processing a crafted MVG triggers unbounded recursion in the drawing engine, exhausting the stack and crashing the process. The flaw is tracked under CWE-674: Uncontrolled Recursion and results in a denial-of-service condition. Any application or service that reads attacker-controlled MVG content is exposed.

Critical Impact
Processing a malicious MVG file causes a stack overflow that terminates the ImageMagick process, disrupting any workflow that renders untrusted vector graphics.

Affected Products

ImageMagick versions prior to 7.1.2-12
Applications embedding ImageMagick libraries (MagickCore) for MVG rendering
Server-side image processing pipelines that accept MVG input

Discovery Timeline

2025-12-30 - CVE-2025-68950 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68950

Vulnerability Analysis

The vulnerability lives in the MVG parser inside MagickCore/draw.c. MVG files can embed references to other images using the image directive, and the loader resolves those references by calling ReadImage. When two MVG files reference each other, the loader recurses between them without any depth or cycle detection. Each recursive call consumes stack space until the thread's stack guard page is hit and the process terminates.

The outcome is a denial of service against any workload that ingests MVG content. Content management systems, thumbnailing services, and document pipelines are typical attack surfaces because they frequently invoke ImageMagick on uploaded files.

Root Cause

The root cause is uncontrolled recursion ([CWE-674]). The pre-patch code allowed MVG files to be read as composite images from within another MVG draw operation. No guard prevented an MVG from referencing itself directly or indirectly through a second MVG. The patch resolves this by excluding the mvg magick type from the set of formats that ReadImage is permitted to load inside the drawing routine.

Attack Vector

Exploitation requires an attacker to supply a crafted MVG file and have the target process it. The attack vector is local in CVSS terms because the input must be read by the ImageMagick process, but in practice this is reachable remotely through any service that accepts user-uploaded images and invokes ImageMagick. No authentication or user interaction is required beyond the normal file submission flow.

               if ((LocaleCompare(clone_info->magick,"ftp") != 0) &&
                   (LocaleCompare(clone_info->magick,"http") != 0) &&
                   (LocaleCompare(clone_info->magick,"https") != 0) &&
+                  (LocaleCompare(clone_info->magick,"mvg") != 0) &&
                   (LocaleCompare(clone_info->magick,"vid") != 0))
                 composite_images=ReadImage(clone_info,exception);
               else

Source: ImageMagick commit 204718c2. The patch adds mvg to the list of magick types that are not recursively loaded as composite images during MVG draw processing, breaking the circular reference chain.

Detection Methods for CVE-2025-68950

Indicators of Compromise

Repeated crashes of processes running convert, magick, or applications linked against libMagickCore
Core dumps or segmentation faults with stack frames repeatedly entering DrawImage and ReadImage
MVG files uploaded to image processing endpoints that contain image directives referencing other MVG resources
Unexpected spikes in worker restarts for thumbnailing, conversion, or preview services

Detection Strategies

Inspect uploaded MVG content for image directives referencing files with the .mvg extension or mvg: protocol prefix
Monitor process exit codes and crash telemetry from any service that invokes ImageMagick on untrusted input
Audit installed ImageMagick versions across hosts and flag any release older than 7.1.2-12
Enable ImageMagick resource limits so excessive recursion produces a loggable ResourceLimitError instead of a silent crash

Monitoring Recommendations

Centralize crash logs from image processing workers and alert on repeated faults in draw.c call paths
Track file-type distributions on upload endpoints and flag unusual volumes of MVG submissions
Correlate web application logs with downstream converter crashes to identify abusive clients

How to Mitigate CVE-2025-68950

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-12 or later across all hosts and container images
Rebuild and redeploy any application that statically links or bundles libMagickCore
Restrict MVG uploads at the application layer until patched versions are in place
Apply strict resource limits using ImageMagick's policy.xml to cap memory, map, and thread usage

Patch Information

The fix is published in ImageMagick 7.1.2-12. Technical details are documented in GitHub Security Advisory GHSA-7rvh-xqp3-pr8j and the source change in commit 204718c2. Linux distributions should pull the vendor-rebased packages as they become available.

Workarounds

Disable the MVG coder in policy.xml to prevent ImageMagick from processing MVG files entirely
Reject uploads with the .mvg extension or image/vnd.mvg MIME type at the ingress layer
Isolate ImageMagick workers in sandboxed containers so a stack overflow does not disrupt neighboring workloads

bash

# /etc/ImageMagick-7/policy.xml - disable the MVG coder
<policymap>
  <policy domain="coder" rights="none" pattern="MVG" />
  <policy domain="coder" rights="none" pattern="VID" />
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
</policymap>