CVE-2026-23874: ImageMagick Buffer Overflow Vulnerability

CVE-2026-23874 Overview

A stack overflow vulnerability exists in ImageMagick, the widely-used open-source software for editing and manipulating digital images. Versions prior to 7.1.2-13 are affected by a stack overflow condition caused by infinite recursion in the Magick Scripting Language (MSL) <write> command when writing to MSL format. This vulnerability can be exploited locally to cause a denial of service condition.

Critical Impact

Local attackers with low privileges can cause application crashes and denial of service by triggering infinite recursion through specially crafted MSL scripts.

Affected Products

• ImageMagick versions prior to 7.1.2-13

Discovery Timeline

• 2026-01-20 - CVE CVE-2026-23874 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-23874

Vulnerability Analysis

This vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition, or "Infinite Loop"). The flaw resides in how ImageMagick's MSL parser handles recursive write operations. When a malicious MSL script instructs the <write> command to output in MSL format, it creates a recursive call pattern that never terminates.

The local attack vector requires an attacker to have low-level privileges on the target system. No user interaction is required to exploit this vulnerability. While the vulnerability does not impact confidentiality or integrity, it can completely disrupt the availability of affected ImageMagick processes.

Root Cause

The root cause of this vulnerability is improper handling of recursive operations within the MSL interpreter. When the <write> command is invoked with MSL as the output format, the parser enters a recursive state without proper termination conditions or recursion depth limits. This results in unbounded stack growth until the process exceeds its stack memory allocation and crashes.

Attack Vector

The attack requires local access to a system running a vulnerable version of ImageMagick. An attacker can craft a malicious MSL script that exploits the recursive write behavior:

1. The attacker creates an MSL script containing a <write> command targeting MSL format output
2. When ImageMagick processes this script, the MSL interpreter begins writing output
3. The write operation recursively invokes the MSL writer, creating an infinite recursion loop
4. The call stack grows unboundedly until stack memory is exhausted
5. The process terminates with a stack overflow, causing denial of service

For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-23874

Indicators of Compromise

• Unexpected ImageMagick process crashes with stack overflow errors
• Log entries indicating segmentation faults in ImageMagick binaries during MSL processing
• Presence of suspicious MSL files containing nested <write> commands targeting MSL output
• Unusual resource consumption patterns before ImageMagick process termination

Detection Strategies

• Monitor system logs for repeated ImageMagick crashes, particularly those related to MSL processing
• Implement file scanning for MSL scripts that contain <write> commands with MSL format specifications
• Use process monitoring to detect abnormal stack growth in ImageMagick processes
• Deploy SentinelOne Singularity to detect and prevent exploitation attempts targeting this vulnerability

Monitoring Recommendations

• Enable detailed logging for ImageMagick operations, especially those processing untrusted input
• Monitor for unusual patterns of MSL file creation or modification
• Track ImageMagick process memory usage and stack allocation patterns
• Implement alerting for repeated service restarts of ImageMagick-dependent applications

How to Mitigate CVE-2026-23874

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-13 or later immediately
• Restrict local access to systems running vulnerable ImageMagick versions
• Review and validate all MSL scripts processed by ImageMagick
• Consider disabling MSL processing if not required for operations

Patch Information

The vulnerability has been addressed in ImageMagick version 7.1.2-13. Users should upgrade to this version or later to remediate the vulnerability. The fix implements proper recursion depth checking and termination conditions for the MSL write operations.

For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Disable MSL coders by modifying the ImageMagick policy.xml configuration file to restrict MSL processing
• Implement input validation to reject MSL files from untrusted sources before processing
• Run ImageMagick processes with reduced privileges and resource limits to contain potential impact
• Use containerization to isolate ImageMagick processing and limit stack resources available to processes

# Configuration example - Disable MSL coder in policy.xml
# Add the following to /etc/ImageMagick-7/policy.xml within the <policymap> section:
<policy domain="coder" rights="none" pattern="MSL" />