CVE-2025-68950 is a medium-severity (CVSS 4) CWE-674 vulnerability in Magick.NET-Q16-AnyCPU. A fix is available for Magick.NET-Q16-AnyCPU — see the affected versions and patch details below.
Magick's failure to limit MVG mutual references forming a loop
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-68950.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2025-68950 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 378,567 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
Magick.NET-Q16-AnyCPU.NETMagick.NET-Q16-HDRI-AnyCPU.NETMagick.NET-Q16-HDRI-OpenMP-arm64.NETMagick.NET-Q16-HDRI-OpenMP-x64.NETMagick.NET-Q16-HDRI-arm64.NETMagick.NET-Q16-HDRI-x64.NETMagick.NET-Q16-HDRI-x86.NETMagick.NET-Q16-OpenMP-arm64+9 moreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Magick fails to check for circular references between two MVGs, leading to a stack overflow.
Details
After reading mvg1 using Magick, the following is displayed:
./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)
#0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726
#1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261
#2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368
#3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311
#4 0x558954afb3a5 in DrawPolygonPrimitive._omp_fn.1 MagickCore/draw.c:5172
#5 0x7f62dd89fa15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)
#6 0x558954ae0f41 in DrawPolygonPrimitive MagickCore/draw.c:5156
#7 0x558954ae5607 in DrawPrimitive MagickCore/draw.c:5875
#8 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
#9 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
#10 0x55895496cedb in RenderFreetype MagickCore/annotate.c:2065
#11 0x55895496702e in RenderType MagickCore/annotate.c:1112
#12 0x558954963da7 in AnnotateImage MagickCore/annotate.c:544
#13 0x558954ae4e0a in DrawPrimitive MagickCore/draw.c:5799
#14 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
#15 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
#16 0x558954755a46 in ReadMVGImage coders/mvg.c:240
#17 0x558954a15ecc in ReadImage MagickCore/constitute.c:743
#18 0x558954ae3c76 in DrawPrimitive MagickCore/draw.c:5705
#19 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
#20 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
#21 0x558954755a46 in ReadMVGImage coders/mvg.c:240
...
Impact
This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| .NETNuGet | Magick.NET-Q16-AnyCPU | all versions | 14.10.1dotnet add package Magick.NET-Q16-AnyCPU --version 14.10.1 |
| .NETNuGet | Magick.NET-Q16-HDRI-AnyCPU | all versions | 14.10.1dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.10.1 |
| .NETNuGet | Magick.NET-Q16-HDRI-OpenMP-arm64 | all versions | 14.10.1dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.10.1 |
| .NETNuGet | Magick.NET-Q16-HDRI-OpenMP-x64 | all versions | 14.10.1dotnet add package Magick.NET-Q16-HDRI-OpenMP-x64 --version 14.10.1 |
| .NETNuGet | Magick.NET-Q16-HDRI-arm64 | all versions | 14.10.1dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.10.1 |
| .NETNuGet | Magick.NET-Q16-HDRI-x64 | all versions | 14.10.1dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.10.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Magick.NET-Q16-AnyCPU, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Magick.NET-Q16-AnyCPU to 14.10.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-68950 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2025-68950 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2025-68950. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Frequently Asked Questions
Is CVE-2025-68950 in your dependencies?
O3 Security finds CVE-2025-68950 across NuGet dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.