Impact
ImageMagick, a widely used open‑source image manipulation library, contains a stack overflow flaw in its Magick Scripting Language (MSL). The issue arises when the `<write>` command is invoked in MSL scripts that trigger infinite recursion. The resulting overflow can cause the process to crash or consume excessive stack memory, leading to a denial‑of‑service condition. This weakness is identified as CWE‑835, indicating uncontrolled recursion or iteration.
Affected Systems
The vulnerability affects all releases of ImageMagick prior to version 7.1.2‑13. Systems running any of those versions are susceptible when they process MSL scripts, particularly the `<write>` command. The fix was implemented in ImageMagick 7.1.2‑13, which terminates recursion safely. Users of earlier releases should verify their installed version and upgrade if necessary.
Risk and Exploitability
The CVSS v3.1 score for this flaw is 5.5, placing it in the moderate severity tier. The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation at present. ImageMagick has not been listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed active exploitation. The likely attack vector involves an attacker supplying a malicious MSL file or command to a system that processes images with ImageMagick; the recursion could be triggered locally or remotely, depending on how the library is invoked in the application stack.
OpenCVE Enrichment
Debian DLA
Debian DSA
Github GHSA