ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to… (CVE-2026-109267)

A stack overflow vulnerability exists in the MSL decoder of ImageMagick versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32. The root cause is an incorrect depth check that does not properly limit recursion depth, allowing specially crafted MSL images to trigger excessive recursion and exhaust the stack. This leads to a denial of service by crashing the process that reads the malicious image. The vulnerability does not affect confidentiality or integrity, only availability.

Successful exploitation causes a denial of service by crashing the ImageMagick process when processing malicious MSL images. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch to ImageMagick version 6.9.13-57 or later, or 7.1.2-32 or later, where this stack overflow vulnerability has been fixed. Since no patch links are provided in the input, verify the vendor advisory for official fixes. Until patched, avoid processing untrusted MSL images to mitigate risk.