Imagemagick — CraftedSignal Threat Feed

ImageMagick XML Bomb Denial-of-Service Vulnerability (CVE-2026-33908)

hello@craftedsignal.io — Mon, 13 Apr 2026 22:18:02 +0000

ImageMagick is a widely used open-source software suite for displaying, converting, and editing raster image and vector image files. A critical vulnerability, identified as CVE-2026-33908, affects versions before 7.1.2-19 and 6.9.13-44. This vulnerability stems from the lack of depth limit during recursive processing of XML files via the DestroyXMLTree() function. An attacker can exploit this by crafting a malicious XML file with deeply nested structures. When ImageMagick parses this file, the recursive function exhausts stack memory, leading to a denial-of-service condition. Successful exploitation can disrupt services relying on ImageMagick, impacting image processing workflows. The vulnerability was addressed in versions 6.9.13-44 and 7.1.2-19.

Attack Chain

An attacker crafts a malicious XML file with deeply nested elements.
The attacker delivers the crafted XML file to a system running a vulnerable version of ImageMagick (e.g., via upload, network share, or email attachment).
A user or automated process triggers ImageMagick to process the malicious XML file using command-line tools such as convert or through a web application using an ImageMagick library.
ImageMagick begins parsing the XML file and calls the DestroyXMLTree() function to free memory.
The DestroyXMLTree() function recursively traverses the XML tree without a depth limit.
Due to the deeply nested structure, the recursive calls consume excessive stack memory.
Stack memory is exhausted, leading to a stack overflow.
The ImageMagick process crashes, resulting in a denial-of-service condition.

Impact

Successful exploitation of CVE-2026-33908 leads to a denial-of-service condition on the affected system. Services relying on ImageMagick for image processing become unavailable, potentially disrupting critical workflows. The CVSS v3.1 base score for this vulnerability is 7.5, indicating a high potential impact on system availability. The number of affected systems depends on the prevalence of vulnerable ImageMagick versions within an organization’s infrastructure.

Recommendation

Upgrade ImageMagick to version 7.1.2-19 or 6.9.13-44 or later to remediate CVE-2026-33908.
Implement file size limits and input validation for XML files processed by ImageMagick to mitigate the risk of malicious file uploads.
Deploy the Sigma rule ImageMagick_XML_Crash to detect potential exploitation attempts by monitoring for ImageMagick process crashes.
Monitor web server logs for unusual patterns of requests with large XML file uploads to identify potential attackers.
Enable process crash reporting on systems running ImageMagick to facilitate incident response and investigation.

ImageMagick Heap Buffer Overflow Vulnerability (CVE-2026-33901)

hello@craftedsignal.io — Mon, 13 Apr 2026 21:16:25 +0000

ImageMagick is a widely used open-source software suite for displaying, converting, and editing raster image files. CVE-2026-33901 describes a heap buffer overflow vulnerability within the MVG (Magick Vector Graphics) decoder. This flaw exists in ImageMagick versions prior to 7.1.2-19 and 6.9.13-44. An attacker can exploit this vulnerability by crafting a malicious image file. When a vulnerable ImageMagick version processes this crafted image, the MVG decoder attempts to write data beyond the allocated buffer, resulting in an out-of-bounds write. This can lead to application crashes, denial-of-service conditions, or potentially arbitrary code execution on the targeted system. Organizations utilizing ImageMagick for image processing are vulnerable.

Attack Chain

An attacker crafts a malicious image file containing a specially designed MVG (Magick Vector Graphics) payload.
The attacker delivers the crafted image file to a target system, potentially via a web upload form or email attachment.
A user or automated process on the target system uses a vulnerable version of ImageMagick to process the image file.
The ImageMagick MVG decoder attempts to parse the malicious MVG data within the image.
Due to the heap buffer overflow vulnerability (CVE-2026-33901), the decoder writes data beyond the allocated buffer on the heap.
This out-of-bounds write corrupts adjacent memory regions.
Depending on the overwritten memory, the application might crash, leading to a denial-of-service.
In some scenarios, this memory corruption could potentially be leveraged for arbitrary code execution, allowing the attacker to gain control of the system.

Impact

Successful exploitation of CVE-2026-33901 can lead to denial of service due to application crashes. In more severe cases, the vulnerability could allow for arbitrary code execution, potentially leading to complete system compromise. The impact will depend on the privileges of the user account running ImageMagick, but could lead to data loss, system instability, or unauthorized access. Organizations using affected versions of ImageMagick are vulnerable.

Recommendation

Upgrade ImageMagick to version 7.1.2-19 or 6.9.13-44 or later to patch CVE-2026-33901.
Monitor web server logs for requests to process image files (e.g., via POST requests) to identify potential exploitation attempts.
Implement input validation to restrict the types and sizes of image files that can be uploaded or processed by ImageMagick.

ImageMagick Multiple Vulnerabilities Leading to DoS, Code Execution, or Data Manipulation

hello@craftedsignal.io — Tue, 31 Mar 2026 08:55:55 +0000

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. According to the BSI advisory, multiple unspecified vulnerabilities exist within ImageMagick that, if exploited, could lead to significant security repercussions. An attacker could leverage these vulnerabilities to trigger a denial-of-service (DoS) condition, potentially disrupting services that rely on ImageMagick for image processing. Furthermore, successful exploitation could grant the attacker the ability to execute arbitrary code on the affected system, leading to complete system compromise. Finally, attackers may be able to manipulate data, leading to data integrity issues or other malicious outcomes. Defenders must prioritize identifying and mitigating instances of vulnerable ImageMagick deployments.

Attack Chain

An attacker identifies a vulnerable version of ImageMagick deployed on a server or endpoint.
The attacker crafts a malicious image file or command containing an exploit payload.
The attacker uploads the malicious image to a web application that uses ImageMagick to process images. Alternatively, the attacker may directly interact with an ImageMagick process on a vulnerable system.
ImageMagick attempts to process the malicious image, triggering the vulnerability.
The vulnerability allows the attacker to execute arbitrary code on the system.
The attacker leverages the code execution to install a backdoor or other malicious software.
The attacker uses the backdoor to establish persistence on the system.
Depending on the attacker’s objective, they may launch a DoS attack, exfiltrate sensitive data, or manipulate data.

Impact

Successful exploitation of these ImageMagick vulnerabilities could result in a denial of service, rendering affected systems and services unavailable. Arbitrary code execution could lead to complete system compromise, potentially impacting all data and services hosted on the affected machine. Data manipulation could lead to data corruption, financial loss, or reputational damage. While the number of victims and specific sectors targeted are not specified in the source, the widespread use of ImageMagick suggests a potentially broad impact across various industries.

Recommendation

Monitor web server logs for suspicious POST requests containing image files with unusual extensions or headers, indicative of malicious image uploads targeting ImageMagick vulnerabilities. Implement a rule targeting webserver logs with category “webserver” and product “linux” or “windows”.
Implement egress filtering to detect and block connections originating from servers running ImageMagick to unusual or malicious IPs/domains, a potential sign of post-exploitation activity. Implement a rule targeting network_connection logs with category “network_connection” and product “linux” or “windows”.
Analyze process creation events for ImageMagick processes spawning child processes with suspicious command-line arguments or executing from unusual directories, potentially indicating code execution following successful exploitation. Implement a rule targeting process_creation logs with category “process_creation” and product “linux” or “windows”.

Android-ImageMagick7 Out-of-Bounds Write Vulnerability (CVE-2026-33854)

hello@craftedsignal.io — Tue, 24 Mar 2026 06:16:22 +0000

CVE-2026-33854 is an out-of-bounds write vulnerability affecting MolotovCherry Android-ImageMagick7 versions prior to 7.1.2-10. This vulnerability stems from improper bounds checking within the image processing logic. The Government Technology Agency of Singapore Cyber Security Group (GovTech CSG) reported this vulnerability. Successful exploitation could lead to a denial of service, information disclosure, or potentially arbitrary code execution on the affected device. Due to the widespread…