CVE-2026-109267: ImageMagick MSL Decoder DOS Vulnerability

CVE-2026-109267 Overview

CVE-2026-109267 is a stack overflow vulnerability in ImageMagick's Magick Scripting Language (MSL) decoder. The flaw stems from an incorrect depth check that fails to limit recursion in coders/msl.c. Attackers can craft a set of malicious MSL images that exhaust the process stack when one of them is parsed, crashing the application and causing a denial of service. The vulnerability affects ImageMagick versions before 6.9.13-57 and 7.x versions before 7.1.2-32. It is classified under [CWE-674: Uncontrolled Recursion].

Critical Impact
Remote attackers can trigger a process crash in any application or service that renders attacker-controlled MSL input through ImageMagick, resulting in denial of service.

Affected Products

ImageMagick versions before 6.9.13-57
ImageMagick 7.x versions before 7.1.2-32
Applications and web services embedding vulnerable ImageMagick libraries for image processing

Discovery Timeline

2026-10-12 - CVE-2026-109267 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109267

Vulnerability Analysis

The vulnerability resides in the MSL (Magick Scripting Language) decoder implemented in coders/msl.c. MSL is an XML-based scripting format that allows chaining image operations, including loading additional MSL files by filename. When the decoder processes a filename keyword that references another MSL image, it recursively invokes the reader to parse the nested image.

The existing depth check intended to limit nested reads was incorrect and did not properly bound recursion. An attacker can supply a chain of crafted MSL files that each reference another MSL image, causing the decoder to recurse until the process stack is exhausted. The result is a stack overflow that terminates the hosting process.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the MSL image reader. The depth-tracking logic did not correctly propagate or enforce a maximum recursion depth across nested filename includes. The upstream patch introduces a guard_key to properly track and limit the recursive read depth during MSL processing.

Attack Vector

Exploitation is network-accessible and requires no authentication or user interaction beyond submitting an image. Any workflow that passes untrusted images to ImageMagick is exposed, including web upload endpoints, document conversion pipelines, email gateways, and content management systems. A successful attack produces a denial of service against the processing worker; integrity and confidentiality are not affected.

// Patch excerpt from coders/msl.c introducing a guard key to
// correctly limit MSL recursion depth during filename include handling.
                if (LocaleCompare(keyword,"filename") == 0)
                  {
                    char
+                      *guard_key,
                      thread_filename[MagickPathExtent];

                    Image

Source: ImageMagick commit 507aee2 and ImageMagick6 commit c108239

Detection Methods for CVE-2026-109267

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes running convert, magick, or library consumers of ImageMagick
Core dumps showing deeply nested call stacks within ReadMSLImage or related MSL decoder functions
Inbound uploads of files with .msl extensions or XML content beginning with <?xml and referencing <image> elements with chained filename attributes

Detection Strategies

Inspect ImageMagick's policy.xml to confirm whether the MSL coder is enabled; environments that have disabled MSL via policy are not exposed
Monitor image-processing worker pods and containers for abnormal restart counts and crash exit codes following file uploads
Hunt web application logs for repeated uploads of small XML-based images followed by backend 5xx responses

Monitoring Recommendations

Alert on process termination events for magick, convert, identify, and application workers that embed libMagickCore
Capture and review stack traces from crash reporters to confirm recursion-induced stack exhaustion in MSL functions
Track installed ImageMagick package versions across endpoints and servers to identify systems running pre-6.9.13-57 or pre-7.1.2-32 builds

How to Mitigate CVE-2026-109267

Immediate Actions Required

Upgrade ImageMagick to version 6.9.13-57 or later, or 7.1.2-32 or later
Disable the MSL coder in policy.xml if upgrading immediately is not feasible
Audit all services that accept user-supplied images and verify that MSL input is not processed

Patch Information

The upstream fix is published in GitHub Security Advisory GHSA-462x-739v-qvq2. Code changes are available in the ImageMagick 7.x commit and the ImageMagick 6.x commit. Additional context is documented in the VulnCheck advisory.

Workarounds

Add a <policy domain="coder" rights="none" pattern="MSL" /> entry to ImageMagick's policy.xml to block MSL decoding
Enforce strict allowlists for input image formats at the application layer and reject MSL and XML-based image payloads
Run ImageMagick inside sandboxed, resource-limited workers with automatic restart to contain the impact of crashes

bash

# /etc/ImageMagick-7/policy.xml - disable the MSL coder
<policymap>
  <policy domain="coder" rights="none" pattern="MSL" />
  <policy domain="coder" rights="none" pattern="MSSA" />
  <policy domain="coder" rights="none" pattern="MSSV" />
</policymap>

# Verify the policy is active
magick -list policy | grep -i msl