CVE-2026-26066: ImageMagick DOS Vulnerability

CVE-2026-26066 Overview

ImageMagick, a widely-used open-source software suite for image editing and manipulation, contains a denial of service vulnerability in its IPTC profile handling functionality. Prior to versions 7.1.2-15 and 6.9.13-40, a specially crafted profile containing invalid IPTC data can trigger an infinite loop when the application attempts to write it using the IPTCTEXT mechanism. This vulnerability allows remote attackers to cause resource exhaustion and denial of service conditions on affected systems.

Critical Impact

Attackers can remotely trigger an infinite loop condition by supplying maliciously crafted image files with invalid IPTC profile data, leading to CPU exhaustion and denial of service on systems processing untrusted images.

Affected Products

• ImageMagick versions prior to 7.1.2-15
• ImageMagick versions prior to 6.9.13-40
• Applications and services utilizing vulnerable ImageMagick libraries for image processing

Discovery Timeline

• 2026-02-24 - CVE-2026-26066 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-26066

Vulnerability Analysis

This vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition - Infinite Loop) and CWE-400 (Uncontrolled Resource Consumption). The flaw resides in ImageMagick's IPTC profile handling code, specifically within the IPTCTEXT writing functionality.

When processing image files containing embedded IPTC metadata profiles, ImageMagick performs validation and transformation operations on the profile data. The vulnerable code path fails to properly validate certain boundary conditions within the IPTC data structure, allowing an attacker to craft a malicious profile that causes the parser to enter a loop without a reachable exit condition.

The attack can be executed over the network without requiring any authentication or user interaction, making it particularly dangerous for web applications and services that automatically process user-uploaded images. Systems running image processing pipelines, content management systems, and web applications using ImageMagick for thumbnail generation or image conversion are at elevated risk.

Root Cause

The root cause stems from improper input validation in the IPTC profile parsing and writing routines. When encountering malformed IPTC data structures, the code fails to implement proper loop termination conditions or iteration limits. The IPTCTEXT writer does not adequately validate the integrity of profile data before attempting to process it, allowing crafted inputs to manipulate loop control variables in a way that prevents normal termination.

Attack Vector

An attacker can exploit this vulnerability by crafting an image file containing a malicious IPTC profile with specifically malformed data structures. When this file is processed by a vulnerable ImageMagick installation—whether through command-line tools, library calls, or web application integration—the infinite loop is triggered.

The attack does not require any special privileges and can be executed remotely by simply submitting a malicious image to any service that processes images using ImageMagick. Common attack scenarios include uploading malicious images to web applications, sending images via email to systems with automatic processing, or placing malicious files in directories monitored by batch processing systems.

Detection Methods for CVE-2026-26066

Indicators of Compromise

• Abnormally high CPU utilization by ImageMagick processes (convert, identify, mogrify, or related binaries)
• ImageMagick processes that remain running indefinitely without completing
• Application threads or worker processes becoming unresponsive during image processing operations
• Memory and resource exhaustion alerts triggered by image processing services

Detection Strategies

• Monitor for ImageMagick processes consuming excessive CPU time (>95% for extended periods)
• Implement process timeout monitoring for image conversion operations
• Deploy file integrity monitoring on ImageMagick binary installations to verify version compliance
• Use application-level logging to track image processing duration and identify anomalous operations

Monitoring Recommendations

• Configure alerting thresholds for CPU consumption by image processing services
• Implement request timeout policies at the web application layer for image upload endpoints
• Monitor system logs for repeated process terminations or out-of-memory events in image processing contexts
• Track ImageMagick version information across infrastructure to ensure patch compliance

How to Mitigate CVE-2026-26066

Immediate Actions Required

• Update ImageMagick to version 7.1.2-15 or later (for version 7.x branch)
• Update ImageMagick to version 6.9.13-40 or later (for version 6.x branch)
• Implement resource limits and process timeouts for ImageMagick operations pending patch deployment
• Review and restrict ImageMagick policy files to limit potentially dangerous operations

Patch Information

The vulnerability has been addressed in ImageMagick versions 7.1.2-15 and 6.9.13-40. Organizations should prioritize upgrading to these patched versions immediately. For detailed patch information and security advisory, refer to the GitHub Security Advisory GHSA-v994-63cg-9wj3.

Workarounds

• Configure ImageMagick policy.xml to restrict IPTC profile processing by adding appropriate policy directives
• Implement application-level timeouts for all ImageMagick operations to prevent runaway processes
• Use sandboxing or containerization with resource limits (CPU, memory, time) for ImageMagick processes
• Consider pre-validating uploaded images using alternative tools before ImageMagick processing

# Example policy.xml configuration to add resource limits
# Add to /etc/ImageMagick-7/policy.xml or equivalent location
# <policy domain="resource" name="time" value="120"/>
# <policy domain="resource" name="thread" value="2"/>
# <policy domain="resource" name="disk" value="1GiB"/>

# Set process timeout using timeout command wrapper
timeout 60 convert input.jpg output.png

# Alternative: Use ulimit to restrict CPU time
ulimit -t 60
convert input.jpg output.png