{"id":"CVE-2026-33908","state":"PUBLISHED","title":"ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()","description":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.","publishedAt":"2026-04-13T21:06:42.682Z","updatedAt":"2026-07-15T01:05:22.443Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["ImageMagick ImageMagick"],"affected":[{"vendor":"ImageMagick","product":"ImageMagick","versions":[{"version":"< 6.9.13-44","status":"affected"},{"version":"< 7.1.2-19","status":"affected"}]}],"references":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","https://access.redhat.com/security/cve/CVE-2026-33908","https://bugzilla.redhat.com/show_bug.cgi?id=2458041","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json"],"weaknesses":["CWE-674","CWE-776"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/33xxx/CVE-2026-33908.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-33908","state":"PUBLISHED","datePublished":"2026-04-13T21:06:42.682Z","dateUpdated":"2026-07-15T01:05:22.443Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-03-24T15:41:47.491Z"},"containers":{"cna":{"title":"ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()","descriptions":[{"lang":"en","value":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}],"affected":[{"vendor":"ImageMagick","product":"ImageMagick","versions":[{"version":"< 6.9.13-44","status":"affected"},{"version":"< 7.1.2-19","status":"affected"}]}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","name":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","name":"https://github.com/ImageMagick/ImageMagick/commit/ccdc01180276aa2cb3d4a32a611aa4f417061cd8","tags":["x_refsource_MISC"]},{"url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","name":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19","tags":["x_refsource_MISC"]},{"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","name":"https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-674","lang":"en","description":"CWE-674: Uncontrolled Recursion","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-04-13T21:06:42.682Z"},"source":{"advisory":"GHSA-fwvm-ggf6-2p4x","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-14T15:29:51.879736Z","id":"CVE-2026-33908","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-14T16:28:36.167Z"}},{"title":"ImageMagick: Magick.NET: ImageMagick: Denial of Service via deeply nested XML file processing","descriptions":[{"lang":"en","value":"A flaw was found in ImageMagick, a free and open-source software for editing and manipulating digital images. When ImageMagick processes an XML file with deeply nested structures, the `DestroyXMLTree()` function, which frees memory, is executed recursively without a depth limit. This can lead to the exhaustion of stack memory, allowing a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted XML file."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"ImageMagick","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"ImageMagick","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-33908","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458041","name":"RHBZ#2458041","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33908.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-776","description":"Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:05:22.443Z"},"datePublic":"2026-04-13T21:06:42.682Z","timeline":[{"lang":"en","time":"2026-04-13T22:01:09.266Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-13T21:06:42.682Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}