CVE-2026-106576
Received Received - Intake

Excessive Parsing Work in ImageMagick

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-106576
EUVD
EUVD-2026-94396

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick < 7.1.2-31

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-834 The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ImageMagick involves a crafted XMP profile that causes excessive resource consumption or iteration when parsing to determine a rational value's numerator and denominator. This leads to a denial of service in versions before 7.1.2-31.

Detection Guidance

Check ImageMagick version with 'convert --version' or 'magick --version'. If version is below 7.1.2-31, the system is vulnerable. Monitor for excessive CPU or memory usage during image processing tasks.

Impact Analysis

The vulnerability can cause system slowdowns or crashes due to excessive resource usage when processing malicious XMP profiles. It requires no privileges or user interaction and can be exploited remotely over a network.

Compliance Impact

This vulnerability causes denial of service through excessive resource consumption when parsing crafted XMP profiles. While not directly violating GDPR or HIPAA, it could impact compliance by disrupting availability of systems processing image files, potentially affecting data access or processing timelines required under these regulations.

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-31 or later. Apply patches from the official ImageMagick repository. Restrict network access to ImageMagick processing if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart