CVE-2026-116144 in ImageMagick
Summary
by MITRE • 10/25/2026
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified within ImageMagick versions prior to 6.9.13-58 and 7.x prior to 7.1.2-33 represents a critical flaw in the processing logic of the Meta Vector Graphics MVG decoder. This component is responsible for interpreting vector-based image definitions, which are commonly used in workflows involving scalable graphics conversion or rendering. The core technical deficiency lies in an uncontrolled recursion mechanism embedded within the parser routines that handle specific structural elements of MVG files. When the decoder encounters certain nested constructs defined by an attacker-controlled input file, it triggers a recursive function call without adequate depth limiting or termination conditions. This behavior deviates from secure coding practices where iterative approaches or explicit stack limits should be enforced to prevent resource exhaustion attacks.
From a technical perspective, this flaw is classified under CWE-675, which denotes the use of operations with an uncontrolled dimension that can lead to unintended side effects such as memory corruption or denial of service. The specific trigger involves supplying a crafted MVG file containing deeply nested recursive definitions. Upon processing these files using specific command-line arguments that invoke the vulnerable decoder path, the application initiates repeated function calls on the call stack. Because there is no mechanism to detect and halt this recursion early, the system's available stack space is rapidly consumed. This leads directly to a stack overflow condition, which is an instance of CWE-789, generally associated with memory corruption but in this context resulting specifically from resource exhaustion due to unbounded recursive execution.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity. An attacker who can induce the processing of a malicious MVG file through ImageMagick's command-line interface or API will cause the target process to crash abruptly. This results in a denial of service for any services relying on that instance, such as web applications performing image conversion on upload or batch processing systems handling user-submitted graphics. The attack does not require authentication if the vulnerable functionality is exposed via network-facing interfaces, making it particularly dangerous in public-facing deployments where automated scanning tools might trigger the vulnerability simply by submitting crafted payloads for validation purposes.
In terms of threat modeling and adversary behavior, this exploitation technique aligns with ATT&CK tactic T1499, Endpoint Denial of Service, specifically under techniques involving resource exhaustion via application layer protocols or services. The attacker leverages a single input vector to disrupt service continuity without needing elevated privileges on the host system beyond what is required to invoke ImageMagick. This highlights the risk associated with libraries that process untrusted media formats in server-side environments where availability is paramount.
Mitigation strategies must prioritize immediate patching of all affected systems to versions 6.9.13-58 or later for the legacy branch, and version 7.1.2-33 or later for the current major release line. These updates include fixes that enforce proper recursion limits within the MVG decoder logic. For environments where immediate patching is not feasible due to dependency constraints, defensive measures should include implementing strict input validation at the network perimeter to reject files with excessive nesting depth before they reach the ImageMagick binary. Additionally, deploying runtime application self-protection tools or configuring operating system-level stack size limits can help mitigate the impact of such crashes by containing the resource exhaustion within a defined boundary rather than allowing it to take down the entire process or host service. Regular auditing of image processing pipelines and limiting the complexity allowed in user-uploaded vector graphics are also recommended operational controls to reduce exposure to similar parser-based vulnerabilities.