CVE-2026-105827: 
ImageMagick Análisis y mitigación de vulnerabilidades

CVE-2026-105827 is an uncontrolled recursion (stack overflow) vulnerability in the CALS decoder of ImageMagick, caused by a missing depth check. It affects ImageMagick versions before 7.1.2-30 (7.x branch) and before 6.9.13-55 (6.x branch). The vulnerability was published on October 8, 2026, with the underlying security advisory (GHSA-wxw6-98rj-hjfr) published by maintainer dlemstra on September 21, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion) and CWE-770 (Allocation of Resources Without Limits or Throttling). The CALS image decoder in ImageMagick lacks a recursion depth check, allowing a specially crafted CALS image file to trigger unbounded recursive function calls that exhaust the process stack, ultimately causing a crash. Exploitation requires no authentication, no user interaction, and no special privileges — an attacker only needs to supply a malicious CALS image to any service or application that processes images via ImageMagick (ImageMagick Advisory, GitHub Advisory). The vulnerability was reported by researcher thinhlx-vn (ImageMagick Advisory).

Successful exploitation results in a denial of service by crashing the ImageMagick process through stack exhaustion. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Any service or application that accepts user-supplied image files and processes them with a vulnerable version of ImageMagick (e.g., web applications, document converters, media pipelines) is at risk of being disrupted or made temporarily unavailable (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, reflecting a very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack is considered automatable — requiring no authentication, privileges, or user interaction — making it straightforward to weaponize if a PoC were to emerge (GitHub Advisory).

1. Reconnaissance: Identify applications or services that accept image uploads or process image files using ImageMagick versions prior to 7.1.2-30 or 6.9.13-55 (e.g., web apps with image upload functionality, document converters).
2. Craft malicious CALS image: Create a specially crafted CALS (Computer Aided Logistics Support) image file designed to trigger unbounded recursion in the CALS decoder — for example, by embedding deeply nested or self-referential structures that exploit the missing depth check.
3. Submit the crafted image: Upload or submit the malicious CALS file to the target service through any available input vector (e.g., file upload form, API endpoint, email attachment processor).
4. Trigger stack overflow: ImageMagick processes the crafted file, entering unbounded recursive calls in the CALS decoder, exhausting the process stack and causing a crash (denial of service) (ImageMagick Advisory, GitHub Advisory).

• Logs: Application or system logs showing ImageMagick process crashes (segmentation faults or stack overflow errors) coinciding with processing of CALS image files; error messages referencing the CALS decoder.
• Process: Unexpected termination of the ImageMagick process (convert, magick, or embedded library calls) with a signal indicating stack overflow (e.g., SIGSEGV, SIGABRT).
• File System: Presence of unusual or unexpected .cal or .cals files in upload directories or temporary processing directories.
• Network: Repeated submission of CALS-format image files (identifiable by file magic bytes or .cal/.cals extensions) from the same source IP, potentially indicating automated DoS attempts.

Upgrade ImageMagick to version 7.1.2-30 or later (7.x branch) or version 6.9.13-55 or later (6.x branch), which contain the fix for this vulnerability (ImageMagick Advisory). If immediate patching is not feasible, restrict or disable processing of CALS image files by configuring ImageMagick's policy.xml to deny the CALS format (e.g., <policy domain="coder" rights="none" pattern="CALS" />). Additionally, validate and restrict file types accepted by any application that invokes ImageMagick to prevent submission of CALS files from untrusted sources (Red Hat Bugzilla).

Red Hat has acknowledged the vulnerability and opened a tracking bug (Bug 2547969) with medium severity, indicating it is under review for impact on Red Hat products (Red Hat Bugzilla). No significant broader community or social media reactions have been identified at this time.