An uncontrolled recursion vulnerability in ImageMagick allows unauthenticated remote attackers to cause a Denial of Service by exhausting stack memory through malicious XML files.

This is an uncontrolled recursion flaw (CWE-674) within the DestroyXMLTree function. An unauthenticated attacker can trigger this condition by supplying a specially crafted XML file with deeply nested structures, causing the application to exhaust its stack memory.

The successful exploitation of this vulnerability results in a Denial of Service, rendering the affected ImageMagick instance or the host application unresponsive. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to business continuity, particularly for services that rely on ImageMagick for automated image processing. System downtime caused by this vulnerability could disrupt critical workflows and lead to operational degradation.

Immediate Action: Update ImageMagick to version 6.9.13-44 or 7.1.2-19, or update the relevant Magick.NET NuGet packages to version 14.12.0.

Proactive Monitoring: Monitor system logs and process resource utilization for sudden spikes in memory consumption or unexpected application crashes associated with XML processing tasks.

Compensating Controls: If immediate patching is not feasible, implement strict validation and sanitization policies for all uploaded XML files to prevent the submission of excessively nested data structures.

Public Exploit Available: No

This vulnerability represents a significant risk to the availability of systems utilizing ImageMagick for image manipulation. Administrators should prioritize the deployment of the provided patches across all development and production environments. Ensuring that software dependencies are updated to the specified versions is the most effective method to eliminate the risk of stack exhaustion attacks.