Technical impact
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak in the XML parsing component. When parsing reaches the configured nesting depth limit, allocated memory is not freed, allowing an attacker to supply deeply nested XML data that repeatedly triggers the leak. The resulting memory exhaustion can crash the ImageMagick process or degrade system performance, effectively denying service to legitimate users. This vulnerability is classified as improper memory management (CWE-401) and failure to release memory (CWE-772).
Affected Systems
The vulnerability affects the ImageMagick software suite, including both the 6.x and 7.x branches. Specifically, any release of ImageMagick prior to 6.9.13‑58 in the 6.x line and prior to 7.1.2‑33 in the 7.x line are impacted. Users who have these older versions installed on servers, web applications, or any environment that processes XML files with ImageMagick should be aware of the risk.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the memory leak by feeding crafted XML data that exceeds the parser's nesting depth limit. The attack vector is inferred to be remote if ImageMagick is exposed to network input (e.g., via a web service), or local if a user can run ImageMagick with the malicious data. The denial of service impact applies to the entire system or application that depends on the affected ImageMagick instance.
Debian DLA