CVE-2026-33908

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674CWE-776

Affected software

No affected versions have been published.

Timeline

Published
Apr 13, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-339095.9OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, several vCVE-2026-33915.5A security flaw has been discovered in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c.CVE-2026-339108.8OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.CVE-2026-339115.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST CVE-2026-339125.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenCVE-2026-339134.9OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenCVE-2026-339147.2OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCCVE-2026-339155.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, five insuCVE-2026-339164.7Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the HaCVE-2026-339178.8OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais aCVE-2026-339188.8OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billiCVE-2026-33925.5A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.