ImageMagick Denial-of-Service Vulnerability When Processing SVG Files

A denial-of-service vulnerability has been identified in ImageMagick versions prior to 7.1.2-12. The issue arises when Magick reads a malicious SVG file, leading to excessive memory consumption and a stack overflow. This vulnerability can cause applications using ImageMagick to parse SVG files to crash.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing applications to crash or become unresponsive.

Reproduction

The vulnerability can be reproduced by generating a malicious SVG file and then using ImageMagick to read this file. This can be done with the command './magick <path_to_svg_file> null', which will cause the application to consume a large amount of memory and eventually crash due to a stack overflow.

Remediation

Users can upgrade to ImageMagick version 7.1.2-12 or later to address this vulnerability.