CVE-2026-25971: 
C# vulnerability analysis and mitigation

CVE-2026-25971 is a stack overflow vulnerability in ImageMagick caused by uncontrolled recursion when processing Magick Scripting Language (MSL) files with circular references. It affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026, with patches released simultaneously. The GitHub Security Advisory assigns a CVSS v3.1 score of 6.2 (Moderate) with a local attack vector, while Feedly's aggregated data reflects a higher estimate of 9.8 (Critical) based on network accessibility of affected services (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-674 (Uncontrolled Recursion) and CWE-787 (Out-of-bounds Write). ImageMagick's ProcessMSLScript function fails to detect circular references between MSL files: when a crafted .msl file references another MSL that in turn references the first, the call chain MSLStartElement → ReadImage → ReadMSLImage → ProcessMSLScript → xmlParseChunk → xmlParseTryOrFinish → MSLStartElement recurses indefinitely, exhausting the process stack and triggering a fatal signal (SIGSEGV/SIGABRT). The vulnerability requires no authentication or user interaction beyond supplying a malicious MSL file to an ImageMagick-processing service (Github Advisory, Github Advisory).

Successful exploitation results in a denial of service (DoS) by crashing the ImageMagick process via stack exhaustion. Confidentiality and integrity are not directly impacted; the primary consequence is availability loss for any service relying on ImageMagick for image processing (e.g., web applications, media pipelines). In multi-tenant or shared environments, repeated crashes could disrupt service for all users of the affected system (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation as of the time of reporting (Github Advisory). The EPSS score is approximately 0.045% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious MSL file: Create a file a.msl that contains an MSL <image> element referencing a second MSL file b.msl, and configure b.msl to reference a.msl back, establishing a circular dependency.
2. Deliver the file to the target: Submit the crafted a.msl to any service or endpoint that passes user-supplied files to ImageMagick for processing (e.g., an image upload endpoint, a CLI wrapper, or a batch processing pipeline).
3. Trigger processing: The service invokes magick a.msl or equivalent, causing ImageMagick to enter the recursive call chain: MSLStartElement → ReadImage → ReadMSLImage → ProcessMSLScript → xmlParseChunk → xmlParseTryOrFinish → MSLStartElement.
4. Stack exhaustion: The unbounded recursion consumes the process stack, resulting in a fatal signal (stack overflow/SIGSEGV), crashing the ImageMagick process and causing a denial of service for the affected service (Github Advisory).

• Logs: ImageMagick process logs or application error logs showing AddressSanitizer:DEADLYSIGNAL or UNKNOWN SIGNAL errors; stack traces referencing MSLStartElement, ReadMSLImage, ProcessMSLScript, or xmlParseChunk in rapid succession.
• Process: Repeated crashes or restarts of the ImageMagick process (magick, convert, or application worker processes); abnormal process termination with signal SIGSEGV or SIGABRT.
• File System: Presence of crafted .msl files in upload directories or temporary processing folders that contain cross-referencing <image> elements pointing to other .msl files.
• Network: Unusual volume of image processing requests (particularly MSL file uploads) to web application endpoints, especially if correlated with service availability degradation.

Upgrade ImageMagick to version 7.1.2-15 (7.x branch) or 6.9.13-40 (6.x branch), which include a patch adding circular reference detection in MSL processing. For Magick.NET users, upgrade to version 14.10.3 or later. If immediate patching is not feasible, disable MSL processing capabilities if not operationally required, and implement network-level or application-level controls to restrict untrusted file uploads to ImageMagick services. Monitor for unexpected ImageMagick process crashes as a potential indicator of exploitation attempts (Github Advisory, Red Hat Bugzilla).

The vulnerability was reported by security researcher unbengable12 and patched promptly by the ImageMagick maintainer dlemstra on February 23, 2026. Downstream Linux distributions including SUSE, openSUSE, Debian, and Amazon Linux 2 have issued security advisories and updated packages. No significant public controversy or notable social media discussion has been observed beyond routine vulnerability tracking and distribution-level patch announcements (Github Advisory).