EUVD-2026-109415
GHSA-7gw6-97q8-rx2p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted deeply nested XML/SVG
-
ExploitParser hits depth limit without freeing memory
-
ImpactRepeat to exhaust memory and deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires that the target application pass attacker-supplied XML-bearing input (such as SVG/MSVG or other XML-based formats ImageMagick parses) through ImageMagick, and that the input nest elements deeply enough to reach the parser's depth limit, which is the exact point where allocated memory is not released. The flaw is remote and unauthenticated per the CVSS vector (PR:N/UI:N) and needs no special configuration beyond ImageMagick processing untrusted XML. Practical impact is LIMITED by the leak being incremental: a single request leaks only a bounded amount, so denial of service requires repeated or sustained malicious requests to exhaust memory, and services that never process untrusted XML-based formats are not exposed. |
| Impact | This is a genuine but moderate-priority issue, not a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, but the only impact is availability (VA:L) with no confidentiality or integrity effect - consistent with a CWE-401 memory leak causing denial of service, not code execution or data exposure. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV (status not indicated), so there is no confirmed active exploitation. No PoC or working exploit reference is supplied - only vendor/coordinator advisories (GitHub GHSA and VulnCheck) - so there is no public exploit identified at time of analysis. The vuln.today Decision label is 'this_month', aligning with a patch-within-the-month cadence rather than emergency action. The signals are internally consistent: network-reachable and easy to trigger, but impact is limited to a gradual memory leak, so real-world risk is elevated for internet-facing services that process untrusted XML/SVG input, yet far below the severity of an RCE. |
| Exploit ScenarioDerived | An attacker submits a crafted image or XML document containing deeply nested elements to an internet-facing service that uses ImageMagick for image processing (for example, an upload or thumbnail pipeline). When ImageMagick's XML parser reaches its nesting depth limit, it fails to release allocated memory; by repeatedly sending such payloads the attacker steadily exhausts server memory, degrading or crashing the service. No public exploit code is identified, but the trigger is simple and requires no authentication per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 25, 2026
Memory exhaustion in ImageMagick's XML parsing code lets remote, unauthenticated attackers degrade availability by feeding crafted, deeply nested XML-bearing input (for example SVG/MSVG or other XML-based formats the library parses) until an allocation cleanup path fails to release memory at the parser's nesting-depth limit. ImageMagick 6.x before 6.9.13-58 and 7.x before 7.1.2-33 are affected; the CVSS 4.0 score of 6.9 reflects low availability-only impact, since each malicious request leaks only a bounded amount and sustained or repeated requests are needed to exhaust memory. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor-released fixes exist in 7.1.2-33 and 6.9.13-58.
RemediationAI
Vendor-released patch: upgrade to ImageMagick 7.1.2-33 (7.x branch) or 6.9.13-58 (6.x branch); both are named as the fixed releases in the upstream advisory GHSA-8ghq-p369-g395 (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8ghq-p369-g395) and the VulnCheck advisory (https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-via-xml-parsing-depth-limit), so distributors and language bindings should be tracked to those versions or their backports. Because exploitation depends on ImageMagick processing attacker-supplied XML-bearing formats, a compensating control for systems that cannot patch immediately is to restrict the XML-based coders in an ImageMagick policy.xml (disabling or delegating SVG/MSVG/MVG handling, for example to an external renderer) - the trade-off is that legitimate vector or SVG conversion workflows will fail or change output. Additionally, capping per-process memory through policy.xml resource limits and container/service memory limits converts an unbounded leak into a predictable restart rather than host-wide exhaustion, at the cost of failed jobs for legitimately large images, and rate-limiting requests that reach XML parsing slows the incremental leak. The upstream advisory should be consulted as the authoritative source for the final fix list.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime) in ImageMagick's XML handling. ImageMagick parses XML-based image formats such as SVG/MSVG, and the parser enforces a maximum element nesting depth; when attacker-supplied input reaches that depth limit mid-parse, memory allocated during parsing is not released on the bail-out path. The result is an incremental, per-parse leak rather than a single-shot crash: each crafted document consumes a bounded amount of memory that is never reclaimed, so the practical outcome is progressive resource exhaustion of the process handling untrusted images. The precise code path and the exact cleanup routine are described only at the level of the upstream advisory (GHSA-8ghq-p369-g395); the trigger is a depth-limit abort while parsing deeply nested XML, and no other conditions are stated in the available sources. CPE data (cpe:2.3:a:imagemagick:imagemagick) confirms the ImageMagick library itself, not a downstream application, is the affected component; exposure therefore depends entirely on whether the embedding service passes untrusted XML-based formats to ImageMagick.
Know when Imagemagick gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote, low-complexity, unauthenticated parsing of untrusted XML gives AV:N/AC:L/PR:N/UI:N; impact is an incremental memory leak so only A:L, with C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Exploit-DB