CVE-2026-46557

What it actually does

ImageMagick versions prior to 7.1.2-23 contain a missing depth check in the fx operation. A crafted fx argument can trigger uncontrolled stack growth and a stack overflow, causing the ImageMagick process handling the operation to crash. Based on the published severity and impact, the expected consequence is denial of service against the local process or any application workflow that invokes ImageMagick on attacker-influenced input; confidentiality and integrity impact are not indicated.

Why it matters to the business

Services that rely on ImageMagick for image transformation, thumbnail generation, document preview, media ingestion, or automated content processing may experience crashes or processing failures if an attacker can cause crafted fx expressions to be evaluated. The vulnerability is not currently listed in CISA KEV, is not associated with ransomware use, has very low EPSS, and has no known mature public exploit, so broad exploitation pressure appears low; however, exposed upload or processing pipelines that pass user-controlled arguments to ImageMagick could still be disrupted.

How an attack unfolds

An attacker first identifies an application, script, batch job, or local processing workflow that invokes ImageMagick with the fx operation or allows user-controlled input to influence an fx expression. The attacker supplies a specially crafted fx argument designed to exceed the missing internal depth check. When ImageMagick evaluates the expression, stack memory is exhausted and the process crashes. In a web or service context, repeated submissions can cause failed image conversions, job queue backlogs, worker restarts, degraded availability, or denial of service for features dependent on ImageMagick.

How to fix it

Upgrade ImageMagick to version 7.1.2-23 or later wherever it is installed, including OS packages, container images, build images, application bundles, and embedded third-party distributions. If immediate upgrade is not possible, restrict or disable use of the fx operation for untrusted input, prevent users from supplying raw ImageMagick command-line arguments, validate and constrain image-processing expressions, run ImageMagick in a sandboxed low-privilege context, enforce CPU and memory limits, and isolate image-processing workers so crashes do not affect core application availability.

How to confirm the fix worked

Confirm the installed ImageMagick version reports 7.1.2-23 or later using commands such as `magick -version`, `convert -version`, or package-manager inventory. Validate that container images and CI/CD build artifacts no longer include vulnerable ImageMagick builds. Review application code and job definitions to ensure untrusted users cannot control `-fx` expressions or raw ImageMagick arguments. Where possible, run regression tests for image transformation workflows and confirm malformed or overly complex fx expressions are rejected or fail safely without crashing worker processes.

Typical attack path

1. Identify a target workflow that uses ImageMagick prior to version 7.1.2-23.
2. Determine whether the workflow invokes the fx operation or accepts user-controlled ImageMagick arguments or expressions.
3. Submit a crafted fx expression that causes excessive recursion or expression depth.
4. Trigger ImageMagick processing through a local command, automated job, upload pipeline, or application feature.
5. Cause the ImageMagick process to terminate due to stack overflow or segmentation fault.
6. Repeat the request or job submission to disrupt image-processing availability.

How to detect it

To assess possible prior exploitation, review application logs, job-worker logs, web upload logs, process execution telemetry, crash dumps, system logs, and container restart events for ImageMagick invocations using the fx operation followed by crashes or abnormal termination. Focus on repeated failures involving `magick`, `convert`, `mogrify`, or `identify`, especially command lines containing `-fx` or `fx:` and occurring near upload, media-processing, or preview-generation requests. On Linux, check syslog, journald, kernel logs, coredumpctl, container runtime logs, and supervisor logs for segmentation faults, stack-smashing messages, worker exits, or crash-loop behavior. In EDR or process telemetry, look for unusual or externally influenced ImageMagick command lines with complex or deeply nested fx expressions. Because no specific public exploit string is provided, detection should emphasize behavioral indicators: `-fx` usage, malformed expression errors, segmentation faults, core dumps, repeated processing retries, and service restarts.

• -fx
• fx:
• magick
• convert
• mogrify
• identify
• Segmentation fault
• segfault
• stack smashing detected
• core dumped
• coredumpctl
• imagemagick
• ImageMagick
• MagickCore
• MagickWand

What your security team should do

• Inventory all ImageMagick installations across servers, containers, developer images, build runners, and application dependencies.
• Prioritize upgrades to ImageMagick 7.1.2-23 or later on systems that process untrusted images or expose image-conversion functionality to users.
• Search application code, scripts, and job definitions for use of `-fx` and assess whether any fx expression is influenced by external input.
• Add guardrails that prevent user-supplied raw ImageMagick command options from reaching `magick`, `convert`, `mogrify`, or related utilities.
• Run ImageMagick workloads with least privilege, resource limits, timeouts, and process isolation to reduce availability impact from crashes.
• Monitor for abnormal ImageMagick process crashes, segmentation faults, repeated worker restarts, and spikes in failed media-processing jobs.