CVE-2026-23874: 
C# vulnerability analysis and mitigation

CVE-2026-23874 is a stack overflow vulnerability via infinite recursion in ImageMagick's MSL (Magick Scripting Language) <write> command when writing to MSL format. It affects all ImageMagick versions prior to 7.1.2-13, as well as Magick.NET NuGet packages prior to version 14.10.2. The vulnerability was discovered by Team FuzzingBrain at Texas A&M University and published on January 19–20, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an infinite recursion loop (CWE-835) in coders/msl.c. When the MSL <write> command handler MSLStartElement() (line ~7045) calls WriteImage() with an output filename specifying MSL format, WriteMSLImage() is invoked, which re-parses the MSL file via ProcessMSLScript(). This triggers xmlParseChunk() → MSLStartElement() again, creating an unbounded call chain: MSLStartElement() → WriteImage() → WriteMSLImage() → ProcessMSLScript() → xmlParseChunk() → MSLStartElement() → .... The recursion can be triggered directly (a self-referencing MSL file) or indirectly (e.g., a.msl → b.msl → a.msl). Exploitation requires libxml2 support to be compiled in and local access to supply a crafted MSL file (GitHub Advisory).

Successful exploitation causes a guaranteed process crash via stack exhaustion, resulting in a denial of service (DoS) with high availability impact. There is no confidentiality or integrity impact — the vulnerability is purely a DoS condition. Any application that processes user-supplied MSL files using a vulnerable ImageMagick version is at risk, including web services, image processing pipelines, and CI/CD systems that rely on ImageMagick for image manipulation (GitHub Advisory, Red Hat Bugzilla).

1. Prepare a malicious MSL file: Create a self-referencing MSL script (e.g., recursive.msl) that contains a <write> command targeting itself in MSL format, such as <write filename="msl:recursive.msl"/>. Indirect recursion (e.g., a.msl referencing b.msl which references a.msl) is also effective.
2. Identify a vulnerable target: Confirm the target system runs ImageMagick prior to version 7.1.2-13 with libxml2 support compiled in (required for MSL parsing).
3. Trigger the vulnerability: Execute ImageMagick with the crafted MSL file as input, e.g., magick MSL:recursive.msl out.png. This can also be triggered via any application that passes user-supplied MSL content to ImageMagick.
4. Observe crash: The process crashes with a stack overflow after 287+ recursive frames, producing an AddressSanitizer: stack-overflow error or a segmentation fault, effectively causing a denial of service (GitHub Advisory).

• Logs: Application or system logs showing ImageMagick process crashes (segmentation faults, SIGSEGV, or SIGABRT signals) when processing MSL files; AddressSanitizer output containing stack-overflow in MSLStartElement or ProcessMSLScript.
• File System: Presence of unexpected or user-supplied .msl files in directories accessible to the ImageMagick process, particularly files containing self-referential <write> commands targeting MSL format.
• Process: Repeated spawning and crashing of ImageMagick worker processes; unusually deep call stacks (287+ frames) visible in core dumps involving MSLStartElement, WriteMSLImage, and ProcessMSLScript.
• Network: In web-facing deployments, repeated HTTP requests submitting MSL-format files or triggering image processing endpoints that result in 500-series errors or service restarts (GitHub Advisory).

Upgrade ImageMagick to version 7.1.2-13 or later, which includes a fix for the infinite recursion condition. For .NET applications using Magick.NET NuGet packages, upgrade to version 14.10.2 or later. As a workaround where patching is not immediately possible, restrict or disable processing of user-supplied MSL files, or configure application-level input validation to reject MSL-format inputs. Debian users should apply the DLA-4448-1 or DSA-6111-1 security updates; Amazon Linux 2 users should apply ALAS2-2026-3132 (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by Team FuzzingBrain at Texas A&M University and published by maintainer dlemstra via the GitHub Security Advisory program. Red Hat tracked the issue via Bugzilla (Bug 2431034) and classified it as medium severity. Multiple Linux distributions including Debian and SUSE issued security advisories and package updates. Coverage has been limited to standard vulnerability tracking outlets with no notable broader media or social media discussion (GitHub Advisory, Red Hat Bugzilla).