{"id":"CVE-2023-1289","aliases":["GHSA-j96m-mjp6-99xr"],"url":"https://o3.security/vulnerability/CVE-2023-1289","summary":"ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in \"/tmp\", possible to leverage DoS","details":"A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in \"/tmp,\" resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.","published":"2023-03-23T00:00:00Z","modified":"2026-08-08T03:47:37.809711642Z","cvss":{"score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"NuGet","name":"Magick.NET-Q16-AnyCPU","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-AnyCPU","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-OpenMP-arm64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-arm64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-x64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-x86","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-OpenMP-arm64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-OpenMP-x64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-OpenMP-x86","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-arm64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-x64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-x86","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q16-HDRI-OpenMP-x64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-AnyCPU","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-OpenMP-arm64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-OpenMP-x64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-arm64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-x64","fixedVersion":"13.0.0"},{"ecosystem":"NuGet","name":"Magick.NET-Q8-x86","fixedVersion":"13.0.0"}],"fix":{"url":"https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4","label":"ImageMagick/ImageMagick@c5b23cb"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1289.json"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1289"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176858"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:47:37.809711642Z"}}