Launch Week Day 1: Announcing Security Design Review
HIGH 7.5 NuGet

ImageMagick has a Stack Overflow in DestroyXMLTree()

GHSA-fwvm-ggf6-2p4x · CVE-2026-33908

Published · Modified

Description

Magick frees the memory of the XML tree via the DestroyXMLTree function; however, this process is executed recursively with no depth limit imposed. When magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack.

Ready to move

Start Securing

Free, no credit card | First findings in minutes