Executive brief
ImageMagick, a widely used tool for digital image processing, is vulnerable to a denial-of-service attack. By providing a specially crafted image file containing deeply nested XML data, an attacker can cause the software to crash. This could disrupt services that rely on ImageMagick for automated image handling, such as web applications or content management systems.
Technical details
A vulnerability exists in ImageMagick's MagickCore component within the `DestroyXMLTree()` function. The function performs recursive memory deallocation of XML trees without a defined depth limit. An attacker can exploit this by providing a maliciously crafted XML file with excessive nesting, leading to uncontrolled recursion (CWE-674) and stack memory exhaustion. This results in a crash of the application (Denial of Service). The vulnerability is reachable over the network without authentication if the application processes user-supplied images or XML data. The issue is resolved in ImageMagick versions 6.9.13-44 and 7.1.2-19, and Magick.NET 14.12.0.
Affected products
- ImageMagick ImageMagick < 6.9.13-44, < 7.1.2-19
- dlemstra Magick.NET < 14.12.0
- Red Hat Red Hat Enterprise Linux 6 All versions
- Red Hat Red Hat Enterprise Linux 7 All versions
Timeline
- 2026-04-12: patched: ImageMagick 7.1.2-19 released
- 2026-04-13: advisory: Initial NVD publication
References
- https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8
- https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x
- https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0
- https://access.redhat.com/security/cve/CVE-2026-33908
- https://bugzilla.redhat.com/show_bug.cgi?id=2458041
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json