ImageMagick Stack Overflow Vulnerability in XML Tree Destruction Process Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in ImageMagick, a popular open-source image manipulation tool. This issue affects versions prior to 7.1.2-19 and 6.9.13-44. The vulnerability arises because the 'DestroyXMLTree()' function, responsible for freeing memory used by XML trees, processes data recursively without a depth limit. When an XML file with deep nesting is handled, the stack memory can be completely used up, causing a crash. This vulnerability has been addressed in ImageMagick versions 7.1.2-19 and 6.9.13-44.

Impact

Exploitation of this vulnerability leads to a stack overflow, causing a crash and disrupting service.

Remediation

Users can upgrade to ImageMagick versions 7.1.2-19 or 6.9.13-44 to address this vulnerability.