CVE-2026-46522: imagemagick Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-46522 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in imagemagick. EPSS estimates a 1.93% chance of exploitation in the next 30 days, higher than 79.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 8 · Related 8Timeline
- 10-06-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.93%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
+0.09 pp
From 1.85% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected systems
NuGet18 products
- magick.net-q16-anycpu< 14.13.1
- Magick.NET-Q16-arm64< 14.13.1
- magick.net-q16-hdri-anycpu< 14.13.1
- Magick.NET-Q16-HDRI-arm64< 14.13.1
- Magick.NET-Q16-HDRI-OpenMP-arm64< 14.13.1
Chainguard1 product
- imagemagick-6< 6.9.13.48-r0
Debian1 product
- imagemagick< 8:6.9.11.60+dfsg-1.6+deb12u10 | < 8:7.1.1.43+dfsg1-1+deb13u9 | < 8:7.1.2.23+dfsg1-1
Imagemagick1 product
- imagemagick< 7.1.2-23 | < 6.9.13-48 | ≥ 7.0.0-0, < 7.1.2-23
Ubuntu1 product
- imagemagickAll versions (No fix recorded)
5 vendors · 22 products
References
11 links- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
