Denial of Service Vulnerability in ImageMagick Software
CVE-2026-33908
7.5HIGH
What is CVE-2026-33908?
ImageMagick is a well-known open-source tool for image editing and manipulation. In certain versions prior to 7.1.2-19 and 6.9.13-44, it contains a vulnerability that arises from an unbounded recursion in the DestroyXMLTree() function when processing XML files with deeply nested structures. This design flaw can lead to stack memory exhaustion, resulting in a Denial of Service (DoS) attack. Users are highly encouraged to update to the latest versions to mitigate this issue and enhance their system security.
Affected Version(s)
ImageMagick < 6.9.13-44 < 6.9.13-44
ImageMagick < 7.1.2-19 < 7.1.2-19