CVE-2026-106572
Received Received - Intake

Stack Overflow in ImageMagick CALS Decoder

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-106572
EUVD
EUVD-2026-94391

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick >= 7.0.0, < 7.1.2-30
ImageMagick ImageMagick < 6.9.13-55

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ImageMagick involves a missing recursion-depth check in the CALS decoder. A crafted CALS image can exhaust the call stack and terminate the process due to uncontrolled recursion. The issue was fixed by adding input validation to check for invalid image header values like zero width, height, type, orientation, or density.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or identify --version. If the version is below 7.1.2-30 or 6.9.13-55, the system is vulnerable.

Impact Analysis

This vulnerability can cause a denial of service by crashing the ImageMagick process when processing a specially crafted CALS image. It requires no privileges or user interaction and can be exploited remotely over a network, potentially disrupting services that rely on ImageMagick.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical flaw in ImageMagick's CALS image decoder causing stack exhaustion. However, exploitation could lead to denial-of-service conditions, potentially impacting system availability required by these regulations.

Mitigation Strategies

Immediately update ImageMagick to version 7.1.2-30 or later for ImageMagick 7, or 6.9.13-55 or later for ImageMagick 6. This can typically be done via package managers like apt, yum, or brew depending on your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106572. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart