CVE-2026-33902

CVE-2026-33902 is a stack overflow vulnerability in ImageMagick's FX expression parser that affects versions below 6.9.13-44 and 7.1.2-19. An attacker can trigger a denial of service by submitting deeply nested expressions to crash the affected process. The vulnerability has been patched in the aforementioned versions. The vulnerability carries a CVSS score of 5.5 (Medium severity) and requires local access with user interaction but no privileges. The attack vector is local, and the only impact is availability, as the vulnerability enables process crashes rather than data compromise or system takeover. The FAUCET Risk Score of 41.0 indicates moderate concern within the broader vulnerability landscape. There is no evidence of active exploitation in the wild. The CVE is not listed on the Known Exploited Vulnerabilities (KEV) catalog, and it remains inactive on threat intelligence hotlists. The low EPSS score of 0.00013 further suggests minimal real-world exploitation activity, indicating this is a lower-priority issue for organizations despite requiring timely patching.