7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33908

CVE-2026-33908: ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the DestroyXMLTree() function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33908

CVE-2026-33908:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q16-x86	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-AnyCPU	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-arm64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x64	nuget	< 14.12.0	14.12.0
Magick.NET-Q8-x86	nuget	< 14.12.0	14.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stack-based buffer overflow due to uncontrolled recursion in the DestroyXMLTree function in ImageMagick's MagickCore/xml-tree.c. When parsing an XML file, ImageMagick builds a tree structure in memory. To free this memory, the DestroyXMLTree function is called, which recursively traverses the tree to destroy each node.

The vulnerability lies in the fact that prior to the patch, there was no limit on the recursion depth. An attacker could craft an XML file with a very deep nesting of tags. When ImageMagick attempts to destroy the in-memory representation of this XML, the DestroyXMLTree function calls itself for each level of nesting via the helper functions DestroyXMLTreeChild and DestroyXMLTreeOrdered. This leads to an excessive number of nested function calls, eventually exhausting the stack space allocated to the program, causing a crash and a Denial of Service (DoS).

The patch mitigates this by introducing a recursion depth counter. A new static function, DestroyXMLTree_, is created which accepts a depth parameter. The original DestroyXMLTree function now simply calls DestroyXMLTree_ with an initial depth of 0. Inside DestroyXMLTree_, the depth is checked against a maximum allowed recursion depth (MagickMaxRecursionDepth). If the depth exceeds this limit, a fatal exception is thrown, preventing the stack overflow. The recursive calls within DestroyXMLTreeChild and DestroyXMLTreeOrdered are updated to call the new DestroyXMLTree_ function, incrementing the depth counter with each call.

Vulnerable functions

DestroyXMLTree

MagickCore/xml-tree.c

The `DestroyXMLTree` function was the entry point for recursively destroying an XML tree. Before the patch, it called `DestroyXMLTreeChild` and `DestroyXMLTreeOrdered` which in turn called `DestroyXMLTree` again, leading to unbounded recursion. A deeply nested XML file would cause this function to be called repeatedly, leading to a stack overflow.

DestroyXMLTreeChild

MagickCore/xml-tree.c

This function iterates through the children of an XML node and calls the main destruction function (`DestroyXMLTree` before the patch) for each child. This is a core part of the recursive process that leads to the stack overflow when processing a deeply nested XML structure.

DestroyXMLTreeOrdered

MagickCore/xml-tree.c

Similar to `DestroyXMLTreeChild`, this function iterates through sibling XML nodes and calls the main destruction function (`DestroyXMLTree` before the patch) for each one. This contributes to the unbounded recursion that causes the stack overflow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.