Uncontrolled Recursion in ImageMagick - CVE-2026-33902

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125881

Uncontrolled Recursion in ImageMagick - CVE-2026-33902

Published: April 14, 2026


Vulnerability identifier: #VU125881
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33902
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the FX expression parser when parsing deeply nested expressions. A remote attacker can provide a deeply nested expression to cause a denial of service.

User interaction is required to process the crafted expression.


Affected software

ImageMagick
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
Development Tools Module
openEuler
Anolis OS
ImageMagick-help
ImageMagick-perl
ImageMagick-devel
ImageMagick-debugsource
ImageMagick-debuginfo
ImageMagick-c++-devel
ImageMagick-c++
ImageMagick
imagemagick (Debian package)
ImageMagick-config-7-SUSE
libMagick++-devel
libMagickWand-7_Q16HDRI10-debuginfo
libMagick++-7_Q16HDRI5-debuginfo
ImageMagick-config-7-upstream-secure
libMagickWand-7_Q16HDRI10
ImageMagick-config-7-upstream-websafe
ImageMagick-config-7-upstream-limited
libMagick++-7_Q16HDRI5
libMagickCore-7_Q16HDRI10-debuginfo
libMagickCore-7_Q16HDRI10
ImageMagick-config-7-upstream-open
perl-PerlMagick
perl-PerlMagick-debuginfo
ImageMagick-djvu
ImageMagick-doc
ImageMagick-libs

How to mitigate CVE-2026-33902

Install security update from vendor's website.

ImageMagick - addressed in versions 6.9.13-44, 7.1.2-19
ImageMagick-help - addressed in versions 6.9.13.44-1, 7.1.2.19-1
ImageMagick-perl - addressed in versions 6.9.13.44-1, 7.1.2.19-1
ImageMagick-devel - addressed in versions 6.9.13.44-1, 7.1.2.19-1
ImageMagick-debugsource - addressed in versions 6.9.13.44-1, 7.1.2.19-1
ImageMagick-debuginfo - addressed in versions 6.9.13.44-1, 7.1.2.19-1
ImageMagick-c++-devel - addressed in versions 6.9.13.44-1, 7.1.2.19-1
ImageMagick-c++ - addressed in versions 6.9.13.44-1, 7.1.2.19-1
ImageMagick - addressed in versions 6.9.13.44-1, 7.1.2.19-1
imagemagick (Debian package) - update to 8:7.1.1.43+dfsg1-1+deb13u8
ImageMagick-config-7-SUSE - update to 7.1.1.43-150700.3.47.1
libMagick++-devel - update to 7.1.1.43-150700.3.47.1
ImageMagick-debugsource - update to 7.1.1.43-150700.3.47.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.47.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.1.43-150700.3.47.1
ImageMagick-config-7-upstream-secure - update to 7.1.1.43-150700.3.47.1
libMagickWand-7_Q16HDRI10 - update to 7.1.1.43-150700.3.47.1
ImageMagick-config-7-upstream-websafe - update to 7.1.1.43-150700.3.47.1
ImageMagick - update to 7.1.1.43-150700.3.47.1
ImageMagick-config-7-upstream-limited - update to 7.1.1.43-150700.3.47.1
libMagick++-7_Q16HDRI5 - update to 7.1.1.43-150700.3.47.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.47.1
ImageMagick-devel - update to 7.1.1.43-150700.3.47.1
libMagickCore-7_Q16HDRI10 - update to 7.1.1.43-150700.3.47.1
ImageMagick-config-7-upstream-open - update to 7.1.1.43-150700.3.47.1
ImageMagick-debuginfo - update to 7.1.1.43-150700.3.47.1
perl-PerlMagick - update to 7.1.1.43-150700.3.47.1
perl-PerlMagick-debuginfo - update to 7.1.1.43-150700.3.47.1
ImageMagick - update to 7.1.2.15-5
ImageMagick-c++ - update to 7.1.2.15-5
ImageMagick-c++-devel - update to 7.1.2.15-5
ImageMagick-devel - update to 7.1.2.15-5
ImageMagick-djvu - update to 7.1.2.15-5
ImageMagick-doc - update to 7.1.2.15-5
ImageMagick-libs - update to 7.1.2.15-5
ImageMagick-perl - update to 7.1.2.15-5

External References

Related Security Bulletins