Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-106565ImageMagick: Infinite Loop in bzip2 compressed images.
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u14 | DEBIAN-CVE-2026-106565 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u13 | DEBIAN-CVE-2026-106565 |
| Debian:14 | imagemagick | 8:7.1.2.33+dfsg1-1 | DEBIAN-CVE-2026-106565 |
| Ubuntu:26.10 | imagemagick | no fix listed | UBUNTU-CVE-2026-106565 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | < 6.9.13-57>= 7.0.0, < 7.1.2-32 |
Weakness: CWE-400, CWE-835 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h x_refsource_CONFIRM
- https://github.com/ImageMagick/ImageMagick/commit/e9872c4a165d869e75d10799c47195725ebf4132 x_refsource_MISC
- https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c x_refsource_MISC
- https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32 x_refsource_MISC
- https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57 x_refsource_MISC