CVE-2026-109267 in ImageMagick
Summary
by MITRE • 10/12/2026
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified as CVE-2024-39856 resides within ImageMagick, a widely used open-source software suite for creating, editing, composing, or converting bitmap images. Specifically, this flaw affects versions prior to 6.9.13-57 and version 7.x prior to 7.1.2-32. The core of the issue lies in the MSL (ImageMagick Script Language) decoder, which is responsible for processing scripts that define image operations. During the parsing and execution of these MSL files, the software fails to implement a correct depth check mechanism when handling recursive calls or nested structures within the script. This oversight allows an attacker to craft malicious MSL images that trigger unbounded recursion during the decoding process.
From a technical perspective, the absence of proper stack depth limiting leads directly to a stack overflow condition. When ImageMagick processes a crafted input file containing deeply nested or recursively defined operations without adequate safeguards, it consumes excessive memory on the call stack. This rapid exhaustion of available stack space results in a crash of the application process. The vulnerability is classified under CWE-789 as an out-of-bounds write due to incorrect calculation of buffer size and also aligns with CWE-675 regarding operations on resources multiple times without checking for maximum limits, specifically concerning recursion depth. In terms of attack classification within the MITRE ATT&CK framework, this behavior is consistent with T1499 Endpoint Denial of Service, where an adversary exploits a software flaw to disrupt service availability rather than gaining unauthorized access or data exfiltration capabilities at this stage.
The operational impact of this vulnerability is primarily centered on denial of service conditions for any system relying on ImageMagick to process untrusted MSL inputs. If the affected version of ImageMagick is deployed in an environment where it processes images uploaded by users, such as a web application or a content management system, attackers can exploit this flaw to crash the server or client-side processing components. This disruption prevents legitimate users from accessing services that depend on image manipulation capabilities. While the primary impact is availability loss, repeated crashes could potentially lead to resource exhaustion at the operating system level if not properly contained by process isolation mechanisms, thereby amplifying the severity of the denial of service effect across a networked infrastructure.
To mitigate this risk, organizations utilizing ImageMagick must upgrade immediately to version 6.9.13-57 or later for the legacy branch and version 7.1.2-32 or later for the current major release line. These updated versions include patches that enforce strict recursion limits within the MSL decoder, preventing the stack overflow condition from occurring even when malicious inputs are provided. Additionally, administrators should implement input validation strategies at the application layer to filter out potentially dangerous script structures before they reach the ImageMagick library. Employing sandboxed environments for processing untrusted images can further reduce the blast radius of any successful exploitation attempt by isolating the process and limiting its access to system resources. Regular monitoring of software dependencies and applying security updates promptly are essential practices to maintain resilience against such memory corruption vulnerabilities in widely adopted image processing libraries.