EUVD-2026-97711
GHSA-m4x9-m38x-9jc8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted MSL image set to MSL-enabled service
-
ExploitTrigger unbounded recursion in MSL decoder
-
ImpactExhaust process stack, crash service (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires the target application to actually invoke ImageMagick's MSL (Magick Scripting Language) coder on attacker-controlled input - MSL is a scripting pseudo-coder, not a normal raster format, and is commonly disabled or restricted in ImageMagick's security policy.xml, which is the primary limiting factor. The attacker must supply a set of crafted MSL files whose cross-references drive the MSL decoder's recursion past the stack limit. No authentication or user interaction is needed (PR:N/UI:N) where such input reaches the decoder, but if MSL is blocked by policy or never processed, the vulnerability is not reachable. Impact is confined to a crash of the processing process (availability only); no code execution or data exposure results. |
| Impact | Signals are consistent and point to a genuine but moderate, availability-only issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 with impact limited to VA:L - a process crash, no confidentiality or integrity loss. CWE-674 (uncontrolled recursion) matches the description's 'incorrect depth check that fails to limit recursion' and is corroborated by the patch commits, which add a guard key and node cleanup in the MSL decoder. There is no CISA KEV listing and no public exploit identified, so the network-vector/no-privilege metrics describe theoretical reach, not observed mass exploitation. A critical caveat the raw score hides: the flaw is in the MSL (Magick Scripting Language) decoder, which is frequently disabled or restricted via policy.xml and is not invoked for ordinary image uploads, so real-world attack surface is narrower than AV:N/PR:N implies. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: real but low-to-moderate priority - patch on normal cycles, prioritizing higher only where MSL processing of untrusted input is exposed. |
| Exploit ScenarioDerived | An attacker submits a set of crafted MSL files to an application that feeds untrusted input through ImageMagick's MSL coder; when one is read, the self-referencing structure recurses without a working depth limit and exhausts the stack, crashing the worker process. No public exploit code was identified at time of analysis, and the impact is denial of service only - repeated submissions can keep a conversion/processing service unavailable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Stack exhaustion in the ImageMagick MSL decoder affects 6.x before 6.9.13-57 and 7.x before 7.1.2-32, allowing remote, unauthenticated attackers to crash the image-processing process by supplying a set of crafted MSL images whose cross-references drive the decoder's recursion past its stack limit; the result is availability-only denial of service with no confidentiality or integrity impact. Reachability is conditional: MSL is a scripting pseudo-coder rather than a normal raster format, so the target application must actually pass attacker-controlled MSL input to ImageMagick, and MSL is commonly disabled or restricted through the security policy.xml, which both the vendor advisory and independent analysis identify as the primary limiting factor. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; vendor patches are available as fixed releases 6.9.13-57 and 7.1.2-32.
RemediationAI
Apply the vendor-released patches: upgrade ImageMagick 6.x to 6.9.13-57 or later, and ImageMagick 7.x to 7.1.2-32 or later, per the advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2; the underlying fixes are the upstream commits https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683 (7.x) and https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b (6.x). If upgrading immediately is not possible, the most effective compensating control is to disable the MSL coder in ImageMagick's policy.xml, for example by adding a policy with domain="coder" rights="none" pattern="MSL" (and reviewing broader coder restrictions for other pseudo-formats such as MVG, MSL, and URL); the trade-off is that any legitimate MSL script processing performed by the application will stop working and will need an alternative mechanism. Additionally, restrict which user-supplied files reach the ImageMagick decoder - reject or quarantine XML/MSL content at the upload boundary and avoid running conversions in a process that shares a stack with other critical services - accepting that input filtering is only a defense-in-depth measure and can be bypassed by content-type or extension tricks. Because the impact is confined to a crash of the processing process, running ImageMagick conversions in isolated, resource-limited worker processes (for example, with restart-on-failure supervision and memory/stack limits) reduces the blast radius of any remaining reachable crash, though this does not fix the underlying defect. Given that no confirmed active exploitation or public exploit code has been identified, remediation can be scheduled through normal patch management, with priority for internet-facing services that accept arbitrary image or XML input and have not disabled MSL.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ImageMagick's MSL (Magick Scripting Language) coder parses XML-based scripts that can reference further images and scripts, including other MSL documents, which makes the decoder inherently recursive. CVE-2026-109267 is rooted in CWE-674 (Uncontrolled Recursion): the decoder performs an incorrect depth check that fails to bound recursion when a crafted set of MSL files cross-references one another, so each nested document consumes additional stack frames until the process stack is exhausted and the program crashes. The upstream fix in coders/msl.c for both ImageMagick 7 (commit 507aee23) and ImageMagick 6 (commit c1082390) adds a guard-key entry into the recursion-tracking splay tree at image start, checks the result of AddValueToSplayTree, throws a ResourceLimitError('MemoryAllocationFailed') when the guard cannot be added or the limit is exceeded, and moves cleanup of the guard key from MSLEndElement into the start-element path so recursion state is maintained consistently. The affected component is the MSL parsing logic used by applications that call ImageMagick to interpret MSL scripts; normal raster decoding paths are not implicated. The provided CPE entries confirm the affected package is imagemagick across the 6.x and 7.x release lines.
Know when Imagemagick gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote crafted input, no auth or interaction where MSL is processed (AV:N/AC:L/PR:N/UI:N); only a single-process crash, so A:L and C/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Exploit-DB