ImageMagick DoS: Deep XML Parsing Exhausts Stack

A critical denial-of-service (DoS) vulnerability, tracked as CVE-2026-33908, has been identified in ImageMagick, the popular open-source software suite for image manipulation. According to the National Vulnerability Database, this flaw stems from the DestroyXMLTree() function, which recursively frees memory for XML trees without imposing a depth limit.

This oversight means that when ImageMagick processes an XML file with excessively deep, nested structures, the recursive calls to DestroyXMLTree() will exhaust the stack memory, leading to a complete DoS. Imagine a never-ending Russian doll scenario for your memory stack — it just keeps going until it crashes. The National Vulnerability Database has assigned this issue a high-severity CVSS score of 7.5, underscoring the potential for significant disruption. The good news is that ImageMagick versions 6.9.13-44 and 7.1.2-19 and later have patched this particular stack exhaustion issue, so folks running older versions are definitely in the danger zone.