CVE-2026-46557: ImageMagick Stack Overflow in fx Operation – Patch Guide

Technical summary

CVE-2026-46557 stems from an improper depth check in ImageMagick's fx operation handler. The vulnerability is classified as CWE-674 (Uncontrolled Recursion), meaning the code does not properly limit how deeply it recurses when processing fx arguments. An attacker can craft malicious input that causes unbounded recursion, resulting in a stack overflow. The CVSS 3.1 score of 6.2 (MEDIUM) reflects a local attack vector with high availability impact but no confidentiality or integrity compromise. The vulnerability requires no user interaction and no special privileges to exploit.

Business impact

This vulnerability poses a denial-of-service risk to any service or application relying on ImageMagick to process user-supplied image data or effect parameters. Organizations using ImageMagick in batch processing pipelines, web image services, or automation tools risk service interruption if an attacker submits malicious input. However, the absence of confidentiality or integrity impact limits the scope—data corruption and information disclosure are not direct concerns. The medium CVSS score reflects that while availability is significantly impacted, the threat surface is local. Non-critical systems using ImageMagick should prioritize patching in regular maintenance windows; critical image processing services should prioritize more aggressively.

Affected systems

ImageMagick versions prior to 7.1.2-23 are vulnerable. Any deployment of ImageMagick in this version range is at risk, regardless of the underlying operating system. This includes systems using ImageMagick as a library in other applications (e.g., web frameworks, document converters, graphics processors) and standalone command-line usage. Organizations should audit their software bill of materials for direct ImageMagick dependencies and indirect inclusion through application dependencies.

Exploitability

Exploitation requires only local access and the ability to supply input to ImageMagick's fx operation. No authentication, user interaction, or special privileges are needed. The attack is straightforward: craft an fx argument with excessive nesting or recursion depth and pass it to an ImageMagick command or API. However, exploitability depends on whether the target application exposes the fx operation to untrusted input—not all ImageMagick use cases exercise this code path. External network exploitation is not feasible due to the local-only attack vector, but internal attackers, compromised processes, or web services that process user-supplied effect parameters are at risk. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade ImageMagick to version 7.1.2-23 or later. This patch version includes the required depth check to prevent unbounded recursion in the fx operation. Organizations should verify the upgrade path for their specific deployment model (system package, container image, language bindings, etc.). After patching, restart any services that depend on ImageMagick to ensure the new library version is in use. For organizations unable to patch immediately, consider restricting access to ImageMagick processing or disabling the fx operation if it is not essential to your workflows.

Patch guidance

Verify and apply version 7.1.2-23 or later from the official ImageMagick repository. If you are using ImageMagick via a downstream package manager (apt, yum, homebrew, pip, npm, etc.), check whether your distribution has backported or released the patch in its stable channel. For containerized deployments, rebuild images with the patched ImageMagick version and redeploy. If ImageMagick is statically linked into your application, recompile with the patched library version. Test the patch in a non-production environment first, especially if ImageMagick is integral to your image processing pipeline, to confirm functionality is preserved.

Detection guidance

Monitor system logs and application error logs for stack overflow exceptions or segmentation faults originating from ImageMagick processes, particularly when processing image files or fx operations. Intrusion detection systems may flag attempts to pass deeply nested or excessively recursive fx arguments. Review web server and application logs for unusual ImageMagick-related API calls with crafted effect parameters. On systems where fx operation is not used, consider logging or blocking any invocations of ImageMagick with fx flags. Endpoint Detection and Response (EDR) tools can alert on unexpected process crashes or resource exhaustion tied to ImageMagick.

Why prioritize this

This vulnerability should be prioritized based on your organization's exposure: (1) If ImageMagick is used in publicly facing web services or processes untrusted input, patch urgently. (2) If ImageMagick is used internally in automation or batch processing with controlled input, schedule patching in the next regular maintenance window. (3) If ImageMagick is not actively used, deprioritize but include in your general library update program. The medium CVSS score and absence of KEV listing indicate this is not an emergency, but the ease of exploitation (local, no privileges required) and the simplicity of the fix warrant relatively quick action for exposed systems.

Risk score, explained

The CVSS 3.1 score of 6.2 (MEDIUM) is driven by: (1) Local attack vector—the attacker must have local access or be able to submit input to a local ImageMagick process; (2) Low attack complexity—no special conditions or timing required to trigger the stack overflow; (3) No privileges required—any user can supply crafted input; (4) High availability impact—the stack overflow causes a denial of service; (5) No confidentiality or integrity impact—the vulnerability does not leak data or corrupt files. The score does not account for widespread deployment or ease of exploitation in public-facing scenarios, which would elevate real-world risk beyond the numeric CVSS rating.

Frequently asked questions