{"id":"JLSEC-2026-932","summary":"ImageMagick's failure to limit MVG mutual causes Stack Overflow","details":"### Summary\n\nMagick fails to check for circular references between two MVGs, leading to a stack overflow.\n\n### Details\n\nAfter reading mvg1 using Magick, the following is displayed:\n\n```\n./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)\n    #0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726\n    #1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261\n    #2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368\n    #3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311\n    #4 0x558954afb3a5 in DrawPolygonPrimitive._omp_fn.1 MagickCore/draw.c:5172\n    #5 0x7f62dd89fa15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)\n    #6 0x558954ae0f41 in DrawPolygonPrimitive MagickCore/draw.c:5156\n    #7 0x558954ae5607 in DrawPrimitive MagickCore/draw.c:5875\n    #8 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n    #9 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n    #10 0x55895496cedb in RenderFreetype MagickCore/annotate.c:2065\n    #11 0x55895496702e in RenderType MagickCore/annotate.c:1112\n    #12 0x558954963da7 in AnnotateImage MagickCore/annotate.c:544\n    #13 0x558954ae4e0a in DrawPrimitive MagickCore/draw.c:5799\n    #14 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n    #15 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n    #16 0x558954755a46 in ReadMVGImage coders/mvg.c:240\n    #17 0x558954a15ecc in ReadImage MagickCore/constitute.c:743\n    #18 0x558954ae3c76 in DrawPrimitive MagickCore/draw.c:5705\n    #19 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n    #20 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n    #21 0x558954755a46 in ReadMVGImage coders/mvg.c:240\n    ...\n```\n\n### Impact\n\nThis is a DoS vulnerability, and any situation that allows reading the mvg file will be affected.","modified":"2026-07-30T18:35:48.476926209Z","published":"2026-07-30T16:02:27.435Z","upstream":["CVE-2025-68950","EUVD-2025-205804","GHSA-7rvh-xqp3-pr8j"],"database_specific":{"sources":[{"id":"CVE-2025-68950","imported":"2026-07-30T14:08:44.550Z","modified":"2026-06-17T09:59:52.903Z","published":"2025-12-30T17:15:43.770Z","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-68950","html_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68950","database_specific":{"status":"Analyzed"}},{"imported":"2026-07-30T14:09:50.071Z","modified":"2025-12-30T23:08:18Z","published":"2025-12-30T23:08:15Z","url":"https://api.github.com/advisories/GHSA-7rvh-xqp3-pr8j","html_url":"https://github.com/advisories/GHSA-7rvh-xqp3-pr8j","id":"GHSA-7rvh-xqp3-pr8j"},{"published":"2025-12-30T16:50:25Z","url":"https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2025-205804","html_url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-205804","id":"EUVD-2025-205804","imported":"2026-07-30T14:08:55.623Z","modified":"2025-12-30T18:11:38Z"}],"license":"CC-BY-4.0"},"references":[{"type":"WEB","url":"https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec"},{"type":"WEB","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j"},{"type":"WEB","url":"https://github.com/advisories/GHSA-7rvh-xqp3-pr8j"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68950"}],"affected":[{"package":{"name":"ImageMagick_jll","ecosystem":"Julia","purl":"pkg:julia/ImageMagick_jll?uuid=c73af94c-d91f-53ed-93a7-00f77d67a9d7"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.2023+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-932.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"credits":[{"name":"ylwango613","contact":["https://github.com/ylwango613"],"type":"REPORTER"}]}