CVE-2026-33908

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674CWE-776

Affected software

VendorProductVersions
ImageMagickImageMagick< 6.9.13-44; < 7.1.2-19
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—

References

Timeline

Published
Apr 13, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-339095.9OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, several vCVE-2026-33915.5A security flaw has been discovered in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c.CVE-2026-339108.8OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.CVE-2026-339115.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST CVE-2026-339125.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenCVE-2026-339134.9OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenCVE-2026-339147.2OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCCVE-2026-339155.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, five insuCVE-2026-339164.7Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the HaCVE-2026-339178.8OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais aCVE-2026-339188.8OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billiCVE-2026-33925.5A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.
CVE-2026-33908: High severity, CVSS 7.5 | Vulnix