CVE-2026-106572 in ImageMagick
Summary
by MITRE • 10/07/2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
ImageMagick serves as a foundational toolset for digital image processing, widely integrated into web applications, content management systems, and automated workflows that handle user-uploaded media. The software supports an extensive array of formats to ensure compatibility across diverse platforms. However, the complexity inherent in supporting such broad format coverage introduces potential attack surfaces within its parsing engines. Specifically, the CALS raster image decoder, which handles Computer-Aided Logistics Support images often used in technical documentation and military applications, contains a critical logic flaw related to how it processes nested or recursive data structures during decoding operations.
The core vulnerability stems from an insufficient validation of recursion depth within the CALS parser implementation. When ImageMagick encounters certain malformed or specially crafted CALS image files, the decoder enters into deep recursive calls without verifying whether the nesting level exceeds a safe threshold. This absence of a boundary check allows an attacker to construct input data that forces the application to consume excessive stack space. As the recursion continues unchecked, the process eventually exhausts the available call stack memory allocated by the operating system.
The operational impact of this flaw is primarily denial-of-service through resource exhaustion and potential remote code execution depending on the deployment context. In a typical server-side scenario where ImageMagick processes uploaded images for display or conversion, an attacker can trigger this condition remotely by submitting a malicious file. The resulting stack overflow causes the application process to crash abruptly. For services relying on continuous availability, such as web servers processing user content, these crashes lead to service interruptions and degraded performance. In more complex environments where memory corruption from stack overflows might be exploited further, there is an elevated risk of achieving arbitrary code execution if other mitigations like ASLR or DEP are bypassed, although the primary manifestation described is a crash condition.
This vulnerability aligns with CWE-675, which describes operations on data with insufficiently verified recursion depth, and falls under MITRE ATT&CK technique T1499, Endpoint Denial of Service via resource exhaustion. The lack of proper input validation allows external actors to disrupt service availability without requiring authentication in many default configurations where image processing is performed automatically upon upload.
To mitigate this risk, organizations must ensure that all instances of ImageMagick are upgraded to version 7.1.2-30 or later for the major branch seven series, and version 6.9.13-55 or later for the legacy six series. These releases incorporate the necessary checks to limit recursion depth and prevent stack exhaustion. Additionally, administrators should implement input validation at the application layer before passing files to ImageMagick, restrict file upload types where possible, and configure process limits such as ulimit settings on Linux systems to contain the impact of any potential crashes. Regular monitoring for abnormal memory usage or frequent service restarts can also help detect exploitation attempts early.