CVE-2026-106572

A flaw was found in ImageMagick. A remote attacker can trigger a Denial of Service (DoS) by submitting a specially crafted Continuous Acquisition and Life-cycle Support (CALS) raster image for processing. Due to a missing recursion depth limit in the CALS decoder, parsing the malicious file exhausts the call stack and causes the application to crash.

Red Hat rates this as Moderate because the impact is limited to partial availability degradation without affecting confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable or restrict the CALS coder in ImageMagick's policy.xml configuration: <policy domain="coder" rights="none" pattern="CALS" />. This prevents processing of CALS images and eliminates the attack vector.