Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M
CVE-2026-46522ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion
High 7.5
In plain English
A high-severity uncontrolled resource consumption in ImageMagick from ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | imagemagick | 7.1.2.24-r0 | ALPINE-CVE-2026-46522 |
| Alpine:v3.24 | imagemagick | 7.1.2.23-r0 | ALPINE-CVE-2026-46522 |
| Debian:12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u10 | DEBIAN-CVE-2026-46522 |
| Debian:13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u9 | DEBIAN-CVE-2026-46522 |
| Debian:14 | imagemagick | 8:7.1.2.23+dfsg1-1 | DEBIAN-CVE-2026-46522 |
| NuGet | magick.net-q16-anycpu | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-arm64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-hdri-anycpu | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-hdri-arm64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-hdri-openmp-arm64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-hdri-openmp-x64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-hdri-x64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-hdri-x86 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-openmp-arm64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-openmp-x64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-x64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q16-x86 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q8-anycpu | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q8-arm64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q8-openmp-arm64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q8-openmp-x64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q8-x64 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| NuGet | magick.net-q8-x86 | 14.13.1 | GHSA-7gg8-qqx7-92g5 |
| Ubuntu:25.10 | imagemagick | no fix listed | UBUNTU-CVE-2026-46522 |
| Ubuntu:26.10 | imagemagick | no fix listed | UBUNTU-CVE-2026-46522 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ImageMagick | ImageMagick | < 7.1.2-23< 6.9.13-48 |
Weakness: CWE-400, CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5 x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-46522 vdb-entry, x_refsource_REDHAT
- RHBZ#2487730 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46522.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:32961 vendor-advisory, x_refsource_REDHAT