CVE-2026-109264 in ImageMagick
Summary
by MITRE • 10/12/2026
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified as CVE-2024-3198 affects versions of ImageMagick prior to 6.9.13-57 and 7.x prior to 7.1.2-32, specifically within the MVG (Meta Vector Graphics) decoder component. This security flaw is classified under CWE-674 as an uncontrolled recursion issue, which leads to a stack overflow condition when processing maliciously crafted input files. The root cause lies in how the parser handles recursive structures or nested references within the MVG format without adequate depth limiting mechanisms. When an attacker provides a file name that triggers this specific decoding path, the application enters an infinite or excessively deep recursion loop, rapidly consuming available memory on the call stack until it exceeds system limits and causes the process to crash.
From an operational perspective, this vulnerability primarily results in a denial of service against services relying on ImageMagick for image processing tasks such as web applications, content management systems, or automated document conversion pipelines. Because the attack vector involves controlling the file name processed by the application, it is particularly dangerous in scenarios where user-supplied filenames are passed directly to ImageMagick functions without sanitization. The resulting crash disrupts service availability and can potentially be leveraged for more severe attacks if combined with other vulnerabilities or if the environment allows for memory corruption exploitation beyond simple stack exhaustion.
This issue aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, as it involves resource exhaustion leading to system instability. Additionally, it relates to CWE-787 in terms of out-of-bounds write implications if the stack overflow leads to memory corruption beyond the intended buffer boundaries. Mitigation strategies should prioritize upgrading ImageMagick to version 6.9.13-57 or later for legacy systems and version 7.1.2-32 or later for current deployments, as these releases include patches that enforce stricter recursion limits within the MVG decoder. In environments where immediate patching is not feasible, implementing input validation to restrict file names passed to ImageMagick and configuring resource limits such as ulimit settings can help mitigate the risk of stack exhaustion attacks until a permanent fix is applied.