Skip to main content

ImageMagick CVE-2026-33902

| EUVDEUVD-2026-22106 MEDIUM
Uncontrolled Recursion (CWE-674)
2026-04-13 GitHub_M GHSA-f4qm-vj5j-9xpw
Denial Of Service Imagemagick
5.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

AV:L because ImageMagick is a file-processing tool, not a network service; UI:R because processing must be triggered; A:H for process crash; no C or I impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:58 vuln.today
Analysis Generated
Jul 24, 2026 - 07:58 vuln.today
Patch released
Apr 14, 2026 - 20:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 21:30 euvd
EUVD-2026-22106
CVE Published
Apr 13, 2026 - 20:59 nvd
MEDIUM 5.5

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a stack overflow vulnerability in ImageMagick's FX expression parser allows an attacker to crash the process by providing a deeply nested expression. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

AnalysisAI

Stack overflow via uncontrolled recursion in ImageMagick's FX expression parser causes process crash when evaluating deeply nested expressions, affecting all versions prior to 6.9.13-44 and 7.1.2-19. The impact is limited to availability - process termination - with no confidentiality or integrity exposure. With EPSS at 0.01% (2nd percentile), SSVC exploitation status confirmed as 'none', and no public exploit code identified, this is a low-urgency finding for most organizations, though web applications and automated pipelines processing untrusted image content carry elevated practical exposure.

Technical ContextAI

ImageMagick's FX expression language allows per-pixel mathematical operations during image manipulation. The vulnerable component is the recursive descent parser in MagickCore/fx.c, specifically the TranslateExpression function, which lacked any depth guard on recursion (CWE-674: Uncontrolled Recursion). The fix introduced in commit d3c0a37485 adds an early return when pfx->teDepth meets or exceeds MagickMaxRecursionDepth, throwing an OptionError rather than continuing into unbounded recursion. The affected CPE is cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* covering all prior versions. The .NET binding library Magick.NET, distributed via NuGet (packages Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, Magick.NET-Q16-HDRI-OpenMP-arm64, Magick.NET-Q16-HDRI-arm64), inherits the vulnerability through its bundled ImageMagick dependency and is fixed in 14.12.0.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 (https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19) or 6.9.13-44, which introduce the recursion depth guard in the FX expression parser. For .NET applications, upgrade Magick.NET to 14.12.0 or later (https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0). Red Hat and SUSE users should monitor their respective security channels for distribution-packaged updates. Where immediate patching is not feasible and ImageMagick processes untrusted inputs, use ImageMagick's policy.xml to restrict resource limits (memory, map, disk, time) and disable the -fx operator if not operationally required - note this will break FX-expression-dependent workflows. Sandboxing the ImageMagick process (e.g., via seccomp, AppArmor, or container isolation) can contain crash impact to the processing worker rather than the parent application.

More in Imagemagick

View all
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2016-3718 MEDIUM POC
5.5 May 05

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct

CVE-2016-3715 MEDIUM POC
5.5 May 05

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-9769 HIGH POC
8.7
CVE-2026-40345 HIGH POC
8.2
CVE-2025-9624 HIGH POC
8.3
CVE-2019-9192 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-33902 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy