CVE-2025-68950: 
C# vulnerability analysis and mitigation

CVE-2025-68950 is a Denial of Service (DoS) vulnerability in ImageMagick caused by uncontrolled recursion when processing MVG (Magick Vector Graphics) files with circular references. Prior to version 7.1.2-12, ImageMagick fails to detect circular references between two MVG files, leading to a stack overflow crash. The vulnerability was disclosed on December 30, 2025, and affects all ImageMagick versions before 7.1.2-12, as well as Magick.NET NuGet packages before version 14.10.1. It carries a CVSS v3.1 base score of 6.2 (Medium) per NVD, though the GitHub Advisory rates it 4.0 (Moderate) (Github Advisory, ImageMagick Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion): ImageMagick's DrawPrimitive function in MagickCore/draw.c does not block recursive loading of MVG-format images, allowing two MVG files that mutually reference each other to trigger infinite recursion. When the magick format is mvg, the code previously called ReadImage() without restriction, enabling a loop between ReadMVGImage → DrawImage → RenderMVGContent → DrawPrimitive → ReadImage → ReadMVGImage until the stack is exhausted. The fix (commit 204718c) adds a single-line check to block MVG from being loaded recursively within DrawPrimitive, alongside existing blocks for ftp, http, https, and vid schemes. No privileges or user interaction are required; the attacker only needs to supply a crafted MVG file to any code path that reads it (ImageMagick Advisory, Patch Commit).

Successful exploitation causes a stack overflow, crashing the ImageMagick process and resulting in a complete loss of availability for the affected service. There is no impact on confidentiality or data integrity — the vulnerability is purely a DoS condition. Any application or pipeline that processes user-supplied MVG files (e.g., web services, image conversion tools, document processors) is at risk of being crashed or rendered unresponsive by a single malicious file (Github Advisory).

1. Craft malicious MVG files: Create two MVG files (L1.mvg and L2.mvg) that mutually reference each other — for example, L1.mvg contains a directive that causes ImageMagick to read mvg:L2.mvg, and L2.mvg contains a directive referencing mvg:L1.mvg.
2. Deliver the file: Supply L1.mvg to any ImageMagick processing pipeline — this could be via a file upload endpoint, a command-line invocation, or an API that accepts image files.
3. Trigger processing: Invoke ImageMagick to process the file, e.g., ./magick mvg:L1.mvg out.png. ImageMagick begins reading L1.mvg, which triggers reading L2.mvg, which triggers reading L1.mvg again, creating infinite recursion.
4. Stack overflow crash: The recursive call chain (ReadMVGImage → DrawImage → RenderMVGContent → DrawPrimitive → ReadImage → ReadMVGImage → ...) exhausts the process stack, causing a fatal crash (SIGSEGV/SIGABRT) and a denial of service (ImageMagick Advisory).

• Process: ImageMagick process (magick, convert, or application embedding libMagickCore) terminating unexpectedly with a segmentation fault or stack overflow signal (SIGSEGV, SIGABRT).
• Logs: AddressSanitizer output containing DEADLYSIGNAL and a stack trace cycling through ReadMVGImage (coders/mvg.c), DrawImage, RenderMVGContent, and DrawPrimitive (MagickCore/draw.c) repeatedly.
• File System: Presence of MVG files in upload directories or temp folders that contain cross-referencing mvg: directives pointing to each other.
• Application Logs: Repeated or sudden process crashes in image processing services coinciding with MVG file ingestion, potentially accompanied by service restarts or watchdog alerts (ImageMagick Advisory).

Upgrade ImageMagick to version 7.1.2-12 or later, which includes the fix that blocks recursive MVG loading within DrawPrimitive. For .NET users, upgrade Magick.NET NuGet packages to version 14.10.1 or later. As a workaround where upgrading is not immediately possible, restrict or disable processing of MVG-format files in ImageMagick's policy configuration (/etc/ImageMagick-7/policy.xml) by adding <policy domain="coder" rights="none" pattern="MVG" />. Debian LTS users should apply the security update referenced in the Debian LTS announcement (Github Advisory, Patch Commit, Debian LTS).

The vulnerability was reported by researcher ylwango613 and published by ImageMagick maintainer dlemstra on December 30, 2025. Debian issued an LTS security update (DLA-4429-1) shortly after disclosure, and openSUSE and Amazon Linux 2 also released patches. Coverage has been limited to routine security advisory aggregators and Linux distribution security channels, with no notable researcher commentary or significant social media discussion beyond automated CVE feeds (Debian LTS, ImageMagick Advisory).