CVE-2026-105827 in ImageMagick
Summary
by MITRE • 10/08/2026
ImageMagick before 7.1.2-30 and 6.9.13-55 contains an uncontrolled recursion vulnerability in the CALS decoder due to a missing depth check. Attackers can supply a crafted CALS image that triggers unbounded recursion, exhausting the stack and crashing the process, resulting in a denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The identified vulnerability resides within the Common Architecture for Library Support (CALS) raster graphics format decoder component of ImageMagick, specifically affecting versions prior to 7.1.2-30 and 6.9.13-55. This flaw is classified as an uncontrolled recursion issue stemming from a critical omission in depth validation logic during the parsing and processing of CALS image data structures. The vulnerability allows for arbitrary code execution control flow manipulation through stack exhaustion rather than direct memory corruption, representing a significant reliability risk for applications that rely on ImageMagick for automated image processing pipelines or user-uploaded content handling.
From a technical perspective, the root cause is categorized under CWE-675, which denotes operations with duplicate resources, specifically uncontrolled recursion depth. When the decoder processes certain malformed CALS files containing nested or recursive structural elements without proper boundary checks, it initiates function calls that do not terminate as expected. Instead of detecting the excessive nesting level and aborting the operation safely, the software continues to push stack frames until the system's allocated memory for the thread is depleted. This behavior aligns with CWE-789, which describes memory exhaustion resulting from uncontrolled resource consumption during processing operations.
The operational impact of this vulnerability is primarily a denial of service condition. An attacker can craft a malicious CALS image file that triggers this infinite recursion loop when processed by an affected version of ImageMagick. Upon execution, the application will rapidly consume available stack space, leading to a segmentation fault or process crash. In environments where ImageMagick operates as part of a web server backend or a batch processing service, such crashes can lead to service unavailability for legitimate users. If the vulnerable library is invoked with elevated privileges, the resulting instability could potentially disrupt broader system operations depending on the deployment architecture and resource isolation mechanisms in place.
This vulnerability maps directly to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of Resource Exhaustion: Overflow. The attack vector involves supplying a specially crafted input file that exploits the lack of depth validation within the decoder logic. While the immediate effect is service disruption rather than data exfiltration or remote code execution via shellcode injection in this specific instance, the instability introduced can serve as a precursor to more complex attacks if combined with other vulnerabilities or used to disrupt security monitoring and logging services that depend on image processing capabilities.
Mitigation strategies require an immediate upgrade of the ImageMagick library to version 7.1.2-30 or later for major releases, or version 6.9.13-55 and above for legacy support branches. These updated versions incorporate the necessary depth checks to prevent unbounded recursion when parsing CALS formats. For organizations unable to patch immediately due to dependency constraints, implementing input validation at the application layer is recommended as a temporary countermeasure. This includes restricting file uploads to trusted sources only, validating image headers before processing, and configuring system-level limits such as ulimit settings for stack size to mitigate the severity of potential crashes. Additionally, deploying web application firewalls or intrusion detection systems capable of identifying anomalous resource consumption patterns can help detect exploitation attempts in real-time.