CVE-2025-68950 — Vulnerability in Magick.NET-Q8-OpenMP-arm64 — CVE...
MEDIUM
ImageMagick's failure to limit MVG mutual causes Stack Overflow
Published December 30, 2025Updated September 10, 2026Source: osv
Summary
### Summary
Magick fails to check for circular references between two MVGs, leading to a stack overflow.
### Details
After reading mvg1 using Magick, the following is displayed:
```
./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)
#0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726
#1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261
#2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368
#3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311
#4 0x558954afb3a5 in DrawPolygonPrimitive._omp_fn.1 MagickCore/draw.c:5172
#5 0x7f62dd89fa15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)
#6 0x558954ae0f41 in DrawPolygonPrimitive MagickCore/draw.c:5156
#7 0x558954ae5607 in DrawPrimitive MagickCore/draw.c:5875
#8 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
#9 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
#10 0x55895496cedb in RenderFreetype MagickCore/annotate.c:2065
#11 0x55895496702e in RenderType MagickCore/annotate.c:1112
#12 0x558954963da7 in AnnotateImage MagickCore/annotate.c:544
#13 0x558954ae4e0a in DrawPrimitive MagickCore/draw.c:5799
#14 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
#15 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
#16 0x558954755a46 in ReadMVGImage coders/mvg.c:240
#17 0x558954a15ecc in ReadImage MagickCore/constitute.c:743
#18 0x558954ae3c76 in DrawPrimitive MagickCore/draw.c:5705
#19 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
#20 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
#21 0x558954755a46 in ReadMVGImage coders/mvg.c:240
...
```
### Impact
This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected.
Advisory Timeline
- First published December 30, 2025 (286 days ago).
- Last revised September 10, 2026 — 253 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Magick.NET-Q8-OpenMP-arm64 to 14.10.1 or laterdotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.10.1
NuGet
Update Magick.NET-Q16-x86 to 14.10.1 or laterdotnet add package Magick.NET-Q16-x86 --version 14.10.1
NuGet
Update Magick.NET-Q16-arm64 to 14.10.1 or laterdotnet add package Magick.NET-Q16-arm64 --version 14.10.1
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-arm64 to 14.10.1 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.1
NuGet
Update Magick.NET-Q8-x86 to 14.10.1 or laterdotnet add package Magick.NET-Q8-x86 --version 14.10.1
NuGet
Update Magick.NET-Q8-AnyCPU to 14.10.1 or laterdotnet add package Magick.NET-Q8-AnyCPU --version 14.10.1
NuGet
Update Magick.NET-Q8-x64 to 14.10.1 or laterdotnet add package Magick.NET-Q8-x64 --version 14.10.1
NuGet
Update Magick.NET-Q16-HDRI-arm64 to 14.10.1 or laterdotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.1
NuGet
Update Magick.NET-Q16-HDRI-OpenMP-x64 to 14.10.1 or laterdotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.1
NuGet
Update Magick.NET-Q16-AnyCPU to 14.10.1 or laterdotnet add package Magick.NET-Q16-AnyCPU --version 14.10.1
NuGet
Update Magick.NET-Q16-OpenMP-arm64 to 14.10.1 or laterdotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.10.1
NuGet
Update Magick.NET-Q16-HDRI-x64 to 14.10.1 or laterdotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.1
NuGet
Update Magick.NET-Q16-HDRI-AnyCPU to 14.10.1 or laterdotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.1
NuGet
Update Magick.NET-Q16-HDRI-x86 to 14.10.1 or laterdotnet add package Magick.NET-Q16-HDRI-x86 --version 14.10.1
NuGet
Update Magick.NET-Q8-OpenMP-x64 to 14.10.1 or laterdotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.10.1
NuGet
Update Magick.NET-Q16-OpenMP-x64 to 14.10.1 or laterdotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.10.1
NuGet
Update Magick.NET-Q8-arm64 to 14.10.1 or laterdotnet add package Magick.NET-Q8-arm64 --version 14.10.1
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (17)
Affects 1 ecosystem: nuget (17).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Magick.NET-Q8-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+48 more) | 14.10.1 |
| Magick.NET-Q16-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+219 more) | 14.10.1 |
| Magick.NET-Q16-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+48 more) | 14.10.1 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+48 more) | 14.10.1 |
| Magick.NET-Q8-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+219 more) | 14.10.1 |
| Magick.NET-Q8-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+203 more) | 14.10.1 |
| Magick.NET-Q8-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+219 more) | 14.10.1 |
| Magick.NET-Q16-HDRI-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+48 more) | 14.10.1 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+100 more) | 14.10.1 |
| Magick.NET-Q16-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+203 more) | 14.10.1 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+48 more) | 14.10.1 |
| Magick.NET-Q16-HDRI-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+200 more) | 14.10.1 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+200 more) | 14.10.1 |
| Magick.NET-Q16-HDRI-x86 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+200 more) | 14.10.1 |
| Magick.NET-Q8-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+100 more) | 14.10.1 |
| Magick.NET-Q16-OpenMP-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+100 more) | 14.10.1 |
| Magick.NET-Q8-arm64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+48 more) | 14.10.1 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-674
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 4.0 score means for each attack dimension.
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
Frequently Asked Questions
- What is CVE-2025-68950?
- ImageMagick's failure to limit MVG mutual causes Stack Overflow This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 4.0/10).
- How do I check if my project is affected by CVE-2025-68950?
- CVE-2025-68950 affects Magick.NET-Q8-OpenMP-arm64, Magick.NET-Q16-x86 and Magick.NET-Q16-arm64 (and 14 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-68950 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
4.0
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-7rvh-xqp3-pr8j
Related CVEs
- CVE-2026-25897MEDIUM
ImageMagick: Heap overflow in sun decoder on 32-bit systems may result in out of bounds write
- CVE-2026-45031MEDIUM
ImageMagick: Policy Bypass in PSD decoder
- GHSA-jqq5-8px3-9m6mMEDIUM
ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix
- CVE-2026-25576MEDIUM
ImageMagick: Out of bounds read in multiple coders read raw pixel data
- CVE-2026-25969MEDIUM
Image Magick has a Memory Leak in coders/ashlar.c
- CVE-2026-61860LOW
ImageMagick: Use-After-Free when freetype initialization fails
- CVE-2026-66011LOW
ImageMagick: Memory Leak when providing invalid options to the cli
- CVE-2026-56369LOW
ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies