Magick.NET CVE-2026-46557

Upgrade all affected Magick.NET NuGet packages to version 14.13.1 or later; this is the vendor-released patch confirmed by GitHub Security Advisory GHSA-rcr6-g7jc-f57g. Update via NuGet package manager using 'dotnet add package Magick.NET-Q16-AnyCPU --version 14.13.1' (substitute the specific variant in use). For applications that cannot be patched immediately, the primary compensating control is to restrict or sanitize fx expression input before it reaches the Magick.NET API - specifically, reject or strip deeply nested recursive expressions through application-layer input validation. Additionally, sandboxing the image-processing process (e.g., running it in a separate low-privilege container or process with resource limits such as ulimit -s on Linux) can contain the impact of a crash to availability without affecting the wider application. Neither workaround eliminates the underlying flaw, and patching to 14.13.1 remains the definitive remediation.