CVE-2026-46557: ImageMagick Buffer Overflow Vulnerability

CVE-2026-46557 Overview

CVE-2026-46557 is a stack overflow vulnerability in ImageMagick, the open-source image editing and manipulation library. The flaw exists in the fx operation, which evaluates mathematical expressions against image pixels. A missing depth check allows a crafted argument to trigger uncontrolled recursion, resulting in a stack overflow [CWE-674]. The issue affects ImageMagick versions prior to 7.1.2-23 and has been patched in version 7.1.2-23. Exploitation requires local access and processing of attacker-supplied input through ImageMagick. The impact is limited to availability, with no confidentiality or integrity loss expected.

Critical Impact
Local attackers can crash ImageMagick processes by supplying a crafted fx expression, denying service to applications that rely on the library.

Affected Products

ImageMagick versions prior to 7.1.2-23
Applications embedding the vulnerable ImageMagick fx evaluator
Server-side image processing pipelines that accept user-controlled fx arguments

Discovery Timeline

2026-06-10 - CVE-2026-46557 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46557

Vulnerability Analysis

The vulnerability resides in the fx operation provided by ImageMagick. The fx feature lets users apply mathematical expressions to images using a small expression language. Parsing and evaluating these expressions relies on recursion to walk the expression tree.

Because the parser does not verify recursion depth before descending further, a sufficiently nested expression consumes all available stack space. When the stack is exhausted, the process crashes. This behavior matches [CWE-674: Uncontrolled Recursion].

The vulnerability requires local attack vector access and no privileges or user interaction. The impact is restricted to availability. Confidentiality and integrity are not affected.

Root Cause

The root cause is a missing depth check inside the fx expression evaluator. The code path accepts arbitrarily nested expressions and recurses without bound. The patch in version 7.1.2-23 adds the necessary depth validation to reject expressions that exceed a safe recursion limit.

Attack Vector

An attacker supplies a crafted fx argument, either through command-line tools such as magick and convert or through an application that forwards user input to the fx operator. Processing the expression triggers the recursive evaluator, exhausts the stack, and terminates the process. For details, refer to the GitHub Security Advisory GHSA-rcr6-g7jc-f57g.

Detection Methods for CVE-2026-46557

Indicators of Compromise

Unexpected crashes or segmentation faults in magick, convert, or processes linking libMagickCore
Core dumps showing deep recursion within fx-related functions such as FxEvaluateSubexpression
Image processing jobs failing repeatedly when handling user-submitted expressions

Detection Strategies

Inventory hosts running ImageMagick and compare installed versions against 7.1.2-23
Inspect application logs for ImageMagick invocations that include -fx with unusually long or nested arguments
Audit web upload endpoints and batch processors that pass user input into ImageMagick command lines or APIs

Monitoring Recommendations

Alert on repeated abnormal terminations of ImageMagick worker processes
Monitor system stack-related faults such as SIGSEGV originating from ImageMagick binaries
Track command-line telemetry for -fx arguments containing high counts of nested parentheses or operators

How to Mitigate CVE-2026-46557

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-23 or later on all affected systems
Restrict or sanitize user-controlled input passed to the -fx operator
Run ImageMagick under resource-constrained service accounts to contain crashes

Patch Information

The ImageMagick maintainers released the fix in version 7.1.2-23, which adds the missing depth check in the fx expression evaluator. Full details are available in the GitHub Security Advisory GHSA-rcr6-g7jc-f57g. Linux distribution maintainers typically backport the fix, so verify the package version provided by your distribution.

Workarounds

Disable or block the fx operator in policy.xml when not required by your workflow
Validate and length-limit any expressions supplied to ImageMagick before invocation
Isolate image processing in sandboxed containers with strict stack and memory limits

bash

# Configuration example: disable the fx coder in /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="FX" />
  <policy domain="filter" rights="none" pattern="fx" />
</policymap>