CVE-2026-23874: ImageMagick Buffer Overflow Vulnerability

CVE-2026-23874 Overview

CVE-2026-23874 is a stack overflow vulnerability in ImageMagick, the open-source image editing and manipulation suite. The flaw exists in the Magick Scripting Language (MSL) <write> command when writing to the MSL format. A crafted MSL script triggers infinite recursion, exhausting the stack and crashing the process. The vulnerability affects all ImageMagick versions prior to 7.1.2-13, which contains the fix. The issue is tracked under CWE-835: Loop with Unreachable Exit Condition and requires local access with low privileges to exploit.

Critical Impact
Local attackers with the ability to supply MSL input can crash ImageMagick processes through infinite recursion, resulting in denial of service for image processing workflows.

Affected Products

ImageMagick versions prior to 7.1.2-13
Applications embedding ImageMagick that expose MSL processing
Server-side image pipelines accepting MSL-formatted input

Discovery Timeline

2026-01-20 - CVE-2026-23874 published to NVD
2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-23874

Vulnerability Analysis

The vulnerability resides in ImageMagick's handling of the Magick Scripting Language (MSL), an XML-based scripting interface for image operations. When the MSL parser processes a <write> command that targets the MSL format itself, the writer re-enters the MSL processing path. This produces unbounded recursive calls without a termination condition. Each recursive call consumes a stack frame until the process exceeds its stack limit and aborts. The result is a denial-of-service condition that terminates the running ImageMagick instance and any pipeline depending on it.

Root Cause

The root cause is missing recursion-depth enforcement in the MSL writer code path. The <write> handler does not detect or prevent the case where the output format reinvokes the same MSL interpreter. This satisfies the conditions for [CWE-835], a loop with an unreachable exit condition. The patched release 7.1.2-13 introduces guards that break the recursive write cycle.

Attack Vector

An attacker requires local access and low privileges to deliver a crafted MSL document to ImageMagick. The attack vector is local because MSL processing is typically invoked through command-line tools such as convert or magick. No user interaction is required after the malicious script is supplied. Confidentiality and integrity are not affected; only availability is impacted because the process crashes deterministically when the recursive write executes.

The vulnerability is triggered by an MSL document containing a <write> element whose target format is MSL. ImageMagick recursively invokes its own MSL writer until the stack is exhausted. See the GitHub Security Advisory GHSA-9vj4-wc7r-p844 for vendor-supplied technical details.

Detection Methods for CVE-2026-23874

Indicators of Compromise

Repeated crashes or segmentation faults in magick, convert, or other ImageMagick binaries
Core dumps showing deep recursive call stacks within MSL writer functions
MSL files containing <write> elements that reference MSL output formats
Spikes in process termination events tied to image processing services

Detection Strategies

Audit application logs for ImageMagick process crashes correlated with MSL or XML input
Inspect uploaded files for .msl extensions or MIME types matching MSL content
Inventory ImageMagick installations and compare version strings against 7.1.2-13
Hunt for command-line invocations passing msl: coder prefixes to ImageMagick utilities

Monitoring Recommendations

Monitor service availability metrics for image processing workers and queue backlogs
Capture stack traces from crashed ImageMagick processes for offline analysis
Track outbound errors from web applications that depend on ImageMagick for thumbnail or conversion tasks
Alert on unexpected execution of the MSL coder in environments that do not require it

How to Mitigate CVE-2026-23874

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-13 or later on all systems
Disable the MSL coder if it is not required for production workflows
Restrict file uploads to known-safe image formats and reject MSL input at the application boundary
Run ImageMagick under resource limits to contain crash impact on shared hosts

Patch Information

The ImageMagick project released version 7.1.2-13 to address this issue. The fix prevents the MSL <write> command from recursively invoking the MSL interpreter. Review the GitHub Security Advisory GHSA-9vj4-wc7r-p844 for full details and apply distribution-specific updates when available.

Workarounds

Edit policy.xml to deny the MSL coder using a <policy domain="coder" rights="none" pattern="MSL" /> rule
Reject user-supplied files whose content or extension identifies them as MSL scripts
Isolate image processing in sandboxed containers with strict CPU and memory limits
Apply seccomp or AppArmor profiles to limit the blast radius of crashing ImageMagick processes

bash

# Configuration example: disable MSL coder in ImageMagick policy.xml
# Typical path: /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="MSL" />
  <policy domain="coder" rights="none" pattern="MSL:*" />
</policymap>