CVE-2026-33908 Details
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
A denial-of-service vulnerability has been identified in ImageMagick, a popular open-source image manipulation tool. This issue affects versions prior to 7.1.2-19 and 6.9.13-44. The vulnerability arises because the 'DestroyXMLTree()' function, responsible for freeing memory used by XML trees, processes data recursively without a depth limit. When an XML file with deep nesting is handled, the stack memory can be completely used up, causing a crash. This vulnerability has been addressed in ImageMagick versions 7.1.2-19 and 6.9.13-44.
Users can upgrade to ImageMagick versions 7.1.2-19 or 6.9.13-44 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| imagemagick imagemagick | < 6.9.13-44 >= 7.0.0-0, < 7.1.2-19 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | New CVE Received | [email protected] |