CVE-2026-33908: ImageMagick XML Processing DoS Vulnerability

CVE-2026-33908 Overview

ImageMagick, a widely-used free and open-source software suite for editing and manipulating digital images, contains a stack exhaustion vulnerability in its XML processing functionality. The vulnerability exists in versions below 7.1.2-19 and 6.9.13-44, where the DestroyXMLTree() function performs recursive memory deallocation without imposing a depth limit. When processing maliciously crafted XML files with deeply nested structures, the recursive execution exhausts stack memory, resulting in a Denial of Service (DoS) condition.

Critical Impact

Attackers can cause ImageMagick to crash by submitting specially crafted XML files with excessive nesting depth, potentially disrupting image processing services and web applications that rely on ImageMagick for image manipulation.

Affected Products

• ImageMagick versions below 7.1.2-19 (version 7.x branch)
• ImageMagick versions below 6.9.13-44 (version 6.x branch)
• Magick.NET versions below 14.12.0

Discovery Timeline

• 2026-04-13 - CVE CVE-2026-33908 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-33908

Vulnerability Analysis

This vulnerability is classified under CWE-674 (Uncontrolled Recursion), which describes a condition where a function calls itself in a loop without proper termination controls. In ImageMagick's case, the DestroyXMLTree() function is responsible for freeing memory allocated to parsed XML tree structures. When processing XML data, ImageMagick builds an in-memory tree representation that mirrors the document's hierarchical structure.

The fundamental issue lies in the recursive nature of the destruction algorithm. For each node in the XML tree, the function recursively calls itself to handle child nodes before deallocating the parent. While this approach works correctly for typical XML documents with reasonable nesting depths, it becomes problematic when an attacker provides an XML file engineered with extreme nesting levels.

Root Cause

The root cause is the absence of depth limiting in the DestroyXMLTree() function's recursive implementation. Each recursive call consumes stack space for local variables, return addresses, and function parameters. When an XML document contains thousands of nested elements, the cumulative stack consumption exceeds available stack memory, triggering a stack overflow condition that crashes the application.

This architectural weakness allows resource exhaustion through controlled input, transforming a legitimate memory management operation into an attack vector.

Attack Vector

The attack is network-exploitable and requires no authentication or user interaction. An attacker can trigger the vulnerability by submitting a specially crafted XML file to any service or application that processes images using vulnerable ImageMagick versions. Common attack scenarios include:

The exploitation mechanism involves creating an XML document with deeply nested elements. When ImageMagick parses this document and subsequently attempts to free the XML tree structure, the recursive destruction function exhausts available stack memory. This causes the ImageMagick process to terminate abnormally, denying service to legitimate users.

Web applications that accept user-uploaded images are particularly susceptible, as ImageMagick is commonly used for image validation, resizing, and format conversion. An attacker needs only to submit a malicious file through any image upload endpoint to trigger the crash.

Detection Methods for CVE-2026-33908

Indicators of Compromise

• Unexpected ImageMagick process crashes or terminations during XML processing operations
• Stack overflow errors in application logs associated with ImageMagick operations
• Segmentation fault signals (SIGSEGV) in processes handling image uploads
• Repeated service restarts for applications using ImageMagick for image processing

Detection Strategies

• Monitor application logs for stack exhaustion errors related to XML parsing in ImageMagick
• Implement file inspection rules to detect XML files with unusually deep nesting structures
• Deploy application-level monitoring to track ImageMagick process stability and crash frequency
• Configure alerting for abnormal memory consumption patterns during image processing operations

Monitoring Recommendations

• Enable process monitoring for ImageMagick worker processes to detect unexpected terminations
• Implement rate limiting on image upload endpoints to reduce potential attack surface
• Configure application performance monitoring (APM) to track resource utilization during image processing
• Review web application firewall (WAF) logs for patterns indicating malicious file uploads

How to Mitigate CVE-2026-33908

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-19 or later for the 7.x branch
• Upgrade ImageMagick to version 6.9.13-44 or later for the 6.x branch
• Update Magick.NET to version 14.12.0 or later if using the .NET wrapper
• Implement input validation to restrict XML nesting depth before processing

Patch Information

The ImageMagick development team has addressed this vulnerability by implementing depth controls in the recursive XML tree destruction function. The fix is available in ImageMagick version 7.1.2-19 and version 6.9.13-44. The specific commit implementing the fix is available for review. For .NET applications, Magick.NET version 14.12.0 incorporates the patched ImageMagick libraries.

Additional details about this vulnerability can be found in the GitHub Security Advisory GHSA-fwvm-ggf6-2p4x.

Workarounds

• Implement pre-processing validation to reject XML files exceeding safe nesting depth thresholds
• Configure policy.xml to restrict XML-based image format processing if not required
• Isolate ImageMagick processing in sandboxed environments with resource limits
• Apply stack size limits to ImageMagick worker processes to contain resource exhaustion

# Configuration example - Restrict ImageMagick XML processing in policy.xml
# Add to /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml

# Disable potentially dangerous coders if XML processing is not required
# <policy domain="coder" rights="none" pattern="MVG" />
# <policy domain="coder" rights="none" pattern="SVG" />

# Set resource limits to contain DoS impact
# <policy domain="resource" name="memory" value="256MiB"/>
# <policy domain="resource" name="map" value="512MiB"/>
# <policy domain="resource" name="disk" value="1GiB"/>