CVE-2026-46522: ImageMagick MIFF Decoder Infinite Loop DoS Vulnerability

Technical summary

The vulnerability resides in ImageMagick's MIFF (Magick Image File Format) decoder, which lacks proper validation when parsing crafted input. Specifically, the decoder fails to validate loop termination conditions or resource bounds before entering a parsing loop, allowing an attacker to construct a malicious MIFF file that triggers unbounded iteration. This maps to CWE-835 (Loop with Unreachable Exit Condition) and CWE-400 (Uncontrolled Resource Consumption). The flaw is triggered during image decoding and does not require user privileges or interaction beyond file submission. The infinite loop exhausts CPU cycles, effectively causing a denial-of-service condition on the affected system.

Business impact

Organizations relying on ImageMagick for batch image processing, content management systems with image upload pipelines, or web services that auto-generate thumbnails face service unavailability risks. A single malicious MIFF file submitted to an image processing queue can consume one or more CPU cores indefinitely, starving legitimate requests and potentially cascading to dependent services. For SaaS platforms or shared hosting environments, this can impact multiple customers. Recovery requires manual process termination and may necessitate service restarts, incurring downtime and operational overhead.

Affected systems

ImageMagick versions 7.1.2.22 and earlier (in the 7.x series) and 6.9.13-47 and earlier (in the 6.x series) are vulnerable. This includes all active deployments not updated to 7.1.2.23 or 6.9.13-48. ImageMagick is commonly embedded in web frameworks, content management systems (WordPress, Drupal), document conversion tools, and containerized microservices. Both command-line usage and programmatic library integration (via PHP, Python, Ruby, Node.js bindings) are affected.

Exploitability

Exploitation is straightforward and requires only network access—no authentication, user interaction, or special configuration is needed beyond exposing an image processing endpoint. An attacker can craft a MIFF file offline and submit it via HTTP, email, or any upload mechanism. The CVSS score of 7.5 (HIGH) reflects the low attack complexity and high availability impact. However, the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation may be limited at present, though this should not delay patching.

Remediation

Upgrade ImageMagick to version 7.1.2.23 (7.x branch) or 6.9.13-48 (6.x branch) immediately. For users unable to update quickly, implement input validation or filtering to reject suspicious MIFF files at the application layer, disable MIFF format support if not required, or isolate image processing services with strict resource limits (CPU quotas, timeout enforcement) to contain the impact of a potential attack. Container orchestration platforms (Kubernetes, Docker) can enforce resource constraints at the pod or container level.

Patch guidance

Verify the ImageMagick version in your deployment: run `convert -version` or `identify -version`. Cross-reference against the vendor's official release notes to confirm that your installed version matches or exceeds 7.1.2.23 (for v7.x) or 6.9.13-48 (for v6.x). If deployed as part of a larger application stack (e.g., PHP-ImageMagick), ensure the entire chain is updated, as package managers may lag behind upstream releases. Test patches in a staging environment with benign MIFF files to confirm functionality before production rollout. For containerized deployments, rebuild images with patched ImageMagick and redeploy.

Detection guidance

Monitor for abnormal CPU usage spikes coinciding with image upload or processing requests, particularly if MIFF files are processed. Enable logging in ImageMagick or the consuming application to capture file names, formats, and processing duration. Look for stuck or hung processes related to `convert`, `identify`, or similar ImageMagick binaries. Implement file-type validation to reject or quarantine MIFF files uploaded from untrusted sources. Web application firewalls (WAF) can be configured to block or flag uploads with MIFF magic bytes or suspicious file extensions. Log analysis tools can detect patterns of repeated process termination or timeout events.

Why prioritize this

This vulnerability merits immediate patching because it enables unauthenticated, remote denial-of-service attacks with minimal effort, impacts a widely-deployed library used across many software stacks, and has a HIGH CVSS score. Although not yet in active exploit databases, the simplicity of crafting a malicious MIFF file makes post-disclosure exploitation likely. Organizations should treat this as a P1 or P2 remediation task depending on their exposure and risk tolerance.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: (1) network-accessible attack vector with no authentication required (AV:N, PR:N); (2) low attack complexity—an attacker needs only to craft and deliver a file (AC:L); (3) no user interaction required (UI:N); (4) unrestricted scope—the impact is contained to the affected system but the flaw can be exploited from any network position (S:U); (5) no confidentiality or integrity impact (C:N, I:N); and (6) high availability impact due to CPU exhaustion and service disruption (A:H). The absence of authentication and interaction requirements elevates the severity, as does the ease of reproducibility.

Frequently asked questions