CVE-2026-105827

ImageMagick: ImageMagick: Denial of Service via uncontrolled recursion in CALS decoder

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.1

Review impact separately from score.

Published · October 8, 2026

Updated · October 9, 2026

Description

A flaw was found in ImageMagick. A remote attacker can trigger a Denial of Service (DoS) by providing a specially crafted image file in the Continuous Acquisition and Life-cycle Support (CALS) format. Because the CALS decoder fails to properly limit recursion depth, processing the malicious image exhausts the application's stack memory and crashes the process.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 · Allocation of Resources Without Limits or Throttling