Magick frees the memory of the XML tree via the DestroyXMLTree function; however, this process is executed recursively with no depth limit imposed. When magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack.
{
"github_reviewed": true,
"nvd_published_at": "2026-04-13T22:16:28Z",
"cwe_ids": [
"CWE-674"
],
"github_reviewed_at": "2026-04-14T00:06:43Z",
"severity": "HIGH"
}