CVE-2026-33902

What it actually does

ImageMagick versions earlier than 7.1.2-19 and 6.9.13-44 contain a stack overflow in the FX expression parser. A deeply nested FX expression can exhaust stack space and terminate the ImageMagick process, causing a denial of service. The known impact is loss of availability for the process handling the expression; the advisory does not indicate confidentiality loss, integrity impact, privilege escalation, or remote code execution.

Why it matters to the business

Systems that use ImageMagick to process user-supplied or automated image transformation requests may experience failed jobs, crashed worker processes, interrupted media pipelines, degraded application functionality, or service instability if malicious or malformed FX expressions are processed. The risk is moderate because exploitation is currently not known to be public, EPSS is very low and flat, and the issue is not in CISA KEV, but ImageMagick is widely embedded in web applications, document workflows, CMS platforms, CI pipelines, and media services, so exposure can be easy to overlook.

How an attack unfolds

An attacker needs a path that causes a vulnerable ImageMagick binary or library to evaluate an FX expression. This may be direct local command execution, a batch processing workflow, or an application feature that exposes ImageMagick transformations to users. The attacker supplies an intentionally deeply nested FX expression. When ImageMagick parses the expression, recursive parsing or stack use grows until the process stack is exhausted, causing the process to crash. In a service architecture, repeated submissions can crash worker processes or keep a processing queue unhealthy, resulting in denial of service for image conversion or dependent application functionality.

How to fix it

Upgrade ImageMagick to a fixed release: 6.9.13-44 or later for the 6.x branch, or 7.1.2-19 or later for the 7.x branch. Update all packaged and embedded copies, including OS packages, container images, application bundles, language bindings that ship ImageMagick, and build environments. If immediate upgrade is not possible, restrict or disable use of the FX expression feature for untrusted input, avoid passing user-controlled transformation expressions to ImageMagick, enforce request size and complexity limits, run image processing in isolated workers with resource limits, and use process supervision to restart failed workers safely.

How to confirm the fix worked

Confirm the installed runtime version with commands such as `magick -version`, `convert -version`, or package-manager inventory and verify it is at least 7.1.2-19 or 6.9.13-44. Validate containers and deployed application images, not only base hosts. Review application code and job definitions for ImageMagick invocations using `-fx`, `-evaluate`, scripted transformations, or user-controlled transformation parameters. If safe test cases are available from the vendor or internal QA, run them in a non-production environment to confirm that deeply nested FX expressions are rejected or handled without process termination. Monitor after patching for absence of ImageMagick crashes under malformed input tests.

Typical attack path

1. Identify an application, service, script, or workflow that uses ImageMagick to evaluate FX expressions or accepts image transformation parameters that are passed to ImageMagick.
2. Confirm that the ImageMagick version is older than 6.9.13-44 or 7.1.2-19.
3. Craft an FX expression with excessive nesting depth intended to trigger stack exhaustion in the parser.
4. Submit the expression through the available interface, such as a command-line invocation, upload-processing workflow, API parameter, or transformation job.
5. Cause the ImageMagick process or worker handling the request to terminate unexpectedly.
6. Repeat submissions if necessary to keep image-processing capacity degraded or unavailable.

How to detect it

Look for evidence of ImageMagick process crashes and suspicious FX-expression use before patching. Relevant sources include application upload and transformation logs, job queue logs, web/API access logs, container stdout/stderr, systemd or init logs, crash dump directories, kernel logs, EDR process telemetry, and package execution audit logs. Search for ImageMagick invocations using `-fx` followed by unusually long or heavily nested expressions, repeated conversion failures from the same source, worker restarts, segmentation faults, stack-overflow messages, core dumps, and abrupt exits of `magick`, `convert`, or `identify`. Because this is a denial-of-service issue, exploitation evidence is more likely to appear as crashes, failed jobs, and repeated malformed requests than as persistent files or post-exploitation artifacts. No public exploitation, KEV listing, ransomware use, or named threat actor activity is currently indicated for this vulnerability.

• -fx
• magick -fx
• convert -fx
• identify -fx
• Segmentation fault
• segfault
• stack overflow
• core dumped
• ImageMagick
• MagickCore
• MagickWand
• convert:
• magick:
• identify:
• /var/crash/
• /var/lib/systemd/coredump/
• core.magick
• core.convert

What your security team should do

• Inventory all ImageMagick installations across servers, containers, CI/CD images, developer tooling, and application dependencies.
• Prioritize upgrades where ImageMagick processes untrusted uploads, API-supplied transformation options, multi-tenant workloads, email attachments, documents, or public web content.
• Upgrade to ImageMagick 6.9.13-44 or 7.1.2-19 or later and rebuild dependent containers and application artifacts.
• Temporarily block or disable user-controlled FX expressions until patched.
• Add resource controls for image-processing workers, including memory, CPU, execution time, queue limits, and automatic restart policies.
• Review logs for historical ImageMagick crashes, repeated failed conversions, or suspicious use of deeply nested FX expressions.
• Add regression tests to prevent reintroduction of unsafe user-controlled ImageMagick transformation parameters.
• Track vendor and distribution package updates because downstream package version strings may differ while still containing the fixed patch.