#1150224 imagemagick: regression in bookworm security updates: SVG <image> with data: URI fails ("unable to open image")

Package:
imagemagick
Source:
imagemagick
Description:
image manipulation programs -- binaries
Submitter:
Guillaume Bihet
Date:
2026-10-07 13:05:01 UTC
Severity:
normal
#1150224#5
Date:
2026-10-07 10:37:16 UTC
From:
To:
Dear Maintainer,

Converting an SVG that includes a PNG image through a data: URI fails on
deb12u13

Steps to reproduce:

The attached image min.svg is a minimal SVG containing a single <image>
element whose href is a data: URI (a small PNG).

Command line :
$   convert min.svg out.png

Observed with 8:6.9.11.60+dfsg-1.6+deb12u13:
`image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMPubB7AAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAAElFTkSuQmCC':
No such file or directory @ error/blob.c/OpenBlob/2990.
error/convert.c/ConvertImageCommand/3234.

Expected: out.png is written. The same command works with deb12u4 and
deb12u6 but fails with deb12u11 and deb12u13, so the regression was likely
introduced between deb12u6 and deb12u11

System information:
  Debian 12 (bookworm), amd64
  Kernel: Linux 6.1.0-34-amd64 Debian 6.1.135-1
  libc6: 2.36-9+deb12u14
  rsvg-convert is not installed


*Guillaume Bihet*
immateriel technical team
#1150224#10
Date:
2026-10-07 12:00:21 UTC
From:
To:
Le mercredi 7 octobre 2026, 12:37:16 heure d’été d’Europe centrale Guillaume Bihet a écrit :

Does removing policy hardening work ?

Could you change policy.xml to allow all coder.

If so it is a feature not a bug, we blocker url due to potential security impact.
it is up to sysadmin to unblock, after risk analysis

If not they are another suspect but could you please try the policy fix


rouca
#1150224#15
Date:
2026-10-07 13:03:19 UTC
From:
To:
Hi,

Thank you for your quick answer, I tried with no policy at all but I get
the same error with deb12u13:

$ sudo mv /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xml.bak

$ convert -list policy
   Policy: Undefined
     rights: None

$ convert min.svg out.png
`image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDILP++tgAAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzozMiswMDowMJNBWGAAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MzIrMDA6MDDiHODcAAAAAElFTkSuQmCC':
No such file or directory @ error/blob.c/OpenBlob/2990.
error/convert.c/ConvertImageCommand/3234.

Doesn't seem to be policy-related...

Best regards,

Guillaume

Guillaume Bihet
immatériel technical team

Le mer. 7 oct. 2026 à 14:00, Bastien Roucaries <rouca@debian.org> a écrit :