PT-2026-76326 — Julia Imagemagick Jll

PT-2026-76326 · Julia · Imagemagick Jll

Published

2026-07-30

Updated

2026-07-30

CVSS v3.1

5.5

Medium

Vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

Stack overflow via infinite recursion in MSL (Magick Scripting Language) <write> command when writing to MSL format.

Version

ImageMagick 7.x (tested on current main branch)
Commit: HEAD
Requires: libxml2 support (for MSL parsing)

Steps to Reproduce

Method 1: Using ImageMagick directly

bash

magick MSL:recursive.msl out.png

Method 2: Using OSS-Fuzz reproduce

bash

python3 infra/helper.py build fuzzers imagemagick
python3 infra/helper.py reproduce imagemagick msl fuzzer recursive.msl

Or run the fuzzer directly:

bash

./msl fuzzer recursive.msl

Expected Behavior

ImageMagick should handle recursive MSL references gracefully by detecting the loop and returning an error.

Actual Behavior

Stack overflow causes process crash:

AddressSanitizer:DEADLYSIGNAL
==PID==ERROR: AddressSanitizer: stack-overflow
  #0 MSLStartElement /src/imagemagick/coders/msl.c:7045
  #1 xmlParseStartTag /src/libxml2/parser.c
  #2 xmlParseChunk /src/libxml2/parser.c:11273
  #3 ProcessMSLScript /src/imagemagick/coders/msl.c:7405
  #4 WriteMSLImage /src/imagemagick/coders/msl.c:7867
  #5 WriteImage /src/imagemagick/MagickCore/constitute.c:1346
  #6 MSLStartElement /src/imagemagick/coders/msl.c:7045
  ... (infinite recursion, 287+ frames)

Root Cause Analysis

In coders/msl.c, the <write> command handler in MSLStartElement() (line ~7045) calls WriteImage(). When the output filename specifies MSL format (msl:filename), WriteMSLImage() is called, which parses the MSL file again via ProcessMSLScript().

If the MSL file references itself (directly or indirectly), this creates an infinite recursion loop:

MSLStartElement() → WriteImage() → WriteMSLImage() → ProcessMSLScript()
  → xmlParseChunk() → MSLStartElement() → ... (infinite loop)

Impact

DoS: Guaranteed crash via stack exhaustion
Affected: Any application using ImageMagick to process user-supplied MSL files

Additional Trigger Paths

The <read> command can also trigger recursion:

Indirect recursion is also possible (a.msl → b.msl → a.msl).

Fuzzer

This issue was discovered using a custom MSL fuzzer:

cpp

#include <cstdint>
#include <Magick++/Blob.h>
#include <Magick++/Image.h>
#include "utils.cc"

extern "C" int LLVMFuzzerTestOneInput(const uint8 t *Data, size t Size)
{
 if (IsInvalidSize(Size))
  return(0);
 try
 {
  const Magick::Blob blob(Data, Size);
  Magick::Image image;
  image.magick("MSL");
  image.fileName("MSL:");
  image.read(blob);
 }
 catch (Magick::Exception)
 {
 }
 return(0);
}

This issue was found by Team FuzzingBrain @ Texas A&M University

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Related Identifiers

JLSEC-2026-935

Affected Products

Imagemagick Jll