CVE-2026-109267: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.1.43+dfsg1-1+deb13u14 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions before 6.9.13-57 or ImageMagick 7.x before 7.1.2-32 are affected when they read attacker-controlled MSL images.
What does an attacker need to exploit the flaw?
An attacker needs to provide a crafted set of MSL images and have one of those images read by the vulnerable MSL decoder. No privileges or user interaction are required according to the supplied vector.
What is the expected impact of successful exploitation?
The crafted input can exhaust the process stack and crash the process, resulting in denial of service. The provided vector indicates no confidentiality or integrity impact.
What should be done if the affected decoder cannot immediately be patched?
Avoid reading untrusted MSL images until ImageMagick can be updated to 6.9.13-57 or later in the 6.x line, or 7.1.2-32 or later in the 7.x line.