CVE-2026-105827: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-105827 is a Denial of Service vulnerability in ImageMagick caused by uncontrolled recursion in the CALS image decoder due to a missing depth check. It affects ImageMagick versions before 7.1.2-30 (7.x branch) and before 6.9.13-55 (6.x branch). The CVE has been marked as Rejected (duplicate) by the CVE authority, with the canonical identifier being CVE-2026-106572 per the upstream ImageMagick advisory (GitHub Advisory, ImageMagick Advisory). It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory). The vulnerability was published on October 8, 2026, and reported by researcher thinhlx-vn (ImageMagick Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion) and CWE-770 (Allocation of Resources Without Limits or Throttling) (GitHub Advisory). The CALS image decoder in ImageMagick lacks a recursion depth check, allowing a specially crafted CALS image file to trigger unbounded recursive calls that exhaust the process stack, ultimately causing a crash (ImageMagick Advisory, Red Hat Bugzilla). The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — an attacker simply needs to supply a malicious CALS image to any service or application that processes images via ImageMagick (GitHub Advisory).

Successful exploitation results in a process crash (stack exhaustion), causing a Denial of Service for any application or service relying on ImageMagick for image processing (Red Hat Bugzilla). There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (GitHub Advisory). Applications such as web services, content management systems, or media pipelines that accept user-supplied image uploads and process them with ImageMagick are particularly at risk of service disruption.

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.305% (21st percentile), indicating a low probability of exploitation in the near term (GitHub Advisory). However, the attack is automatable and requires no privileges or user interaction, making it straightforward to weaponize if a PoC were developed.

1. Reconnaissance: Identify services or web applications that accept image uploads and process them using ImageMagick (e.g., image conversion APIs, CMS platforms, media processing pipelines) running vulnerable versions (< 7.1.2-30 or < 6.9.13-55).
2. Craft malicious CALS image: Create a specially crafted CALS (Computer Aided Logistics Support) image file designed to trigger unbounded recursion in ImageMagick's CALS decoder — for example, by embedding deeply nested or self-referential structures that exploit the missing depth check.
3. Submit the crafted file: Upload or submit the malicious CALS image to the target service via any available input channel (e.g., file upload form, API endpoint, email attachment processed by the server).
4. Trigger stack exhaustion: When ImageMagick processes the crafted file, the CALS decoder enters uncontrolled recursion, exhausting the process stack and causing a crash, resulting in a Denial of Service for the affected application (ImageMagick Advisory, Red Hat Bugzilla).

• Logs: Application or system logs showing ImageMagick process crashes (segmentation faults or stack overflow errors) coinciding with CALS image processing; error messages referencing the CALS decoder or stack exhaustion.
• File System: Presence of unexpected or anomalous .cal or .cals image files in upload directories or temporary processing folders.
• Process: Repeated abnormal termination of the ImageMagick process (convert, magick) or worker processes of applications that invoke ImageMagick; core dump files generated in the working directory of the ImageMagick process.
• Network: Repeated upload requests containing CALS-format image files (identifiable by file magic bytes or .cal/.cals extensions) from the same or rotating source IPs, particularly if followed by service unavailability.

Upgrade ImageMagick to version 7.1.2-30 or later (7.x branch) or 6.9.13-55 or later (6.x branch), which include the fix for this vulnerability (ImageMagick Advisory, GitHub Advisory). If immediate patching is not feasible, restrict or disable processing of CALS image files by configuring ImageMagick's policy.xml to deny the CALS format, or filter CALS file uploads at the application layer (GitHub Advisory). Note that this CVE has been rejected as a duplicate; the canonical advisory is GHSA-wxw6-98rj-hjfr / CVE-2026-106572, so patch tracking should reference those identifiers (ImageMagick Advisory).

Red Hat has tracked this vulnerability via their Bugzilla system (Bug 2547969) with a medium severity rating, indicating it is on their radar for downstream package assessment (Red Hat Bugzilla). The upstream ImageMagick project promptly published a security advisory (GHSA-wxw6-98rj-hjfr) and credited reporter thinhlx-vn (ImageMagick Advisory). No significant broader media coverage or notable social media discussion has been observed, consistent with the moderate severity and lack of active exploitation.