ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Vulnerability

Analysis

CVE-2026-32636 affects ImageMagick, an open-source image processing suite. The vulnerability resides in the NewXMLTree method, which is used for parsing XML data. A bug in this method can lead to an out-of-bounds write of a single zero byte, resulting in a crash [1][2]. The issue is present in all versions prior to 7.1.2-17 for the 7.x series and 6.9.13-42 for the legacy 6.x series [2].

Exploitation

The attack surface involves processing a crafted image file that triggers the XML parsing path in ImageMagick. No authentication is required; exploitation can occur when a user or automated service processes a malicious file via ImageMagick's command-line tools or APIs [1]. The out-of-bounds write occurs during the XML tree construction, potentially corrupting memory [2].

Impact

Successful exploitation leads to a denial-of-service condition via application crash. The description does not indicate code execution or privilege escalation, limiting the impact to availability [2]. Given ImageMagick's widespread use in web services and automation pipelines, a crash could disrupt critical image processing workflows.

Mitigation

The vulnerability has been patched in ImageMagick versions 7.1.2-17 and 6.9.13-42 [2][3]. Users are advised to update to these releases or apply vendor-supplied fixes. No workarounds have been publicly documented, and the CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog.