5.3

CVE-2026-106572

ImageMagick: Stack Overflown CALS decoder due to missing depth check.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerImageMagick
≫
Produkt ImageMagick
Version >= 7.0.0, < 7.1.2-30
Status affected
Version < 6.9.13-55
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-674 Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr
https://github.com/ImageMagick/ImageMagick/commit/19bce64e3667ff03
https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee
https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30
https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55