CVE-2026-46522: ImageMagick MIFF Decoder DoS Vulnerability

CVE-2026-46522 Overview

CVE-2026-46522 is a denial-of-service vulnerability in ImageMagick, the open-source image processing library used across web applications, content management systems, and automated media pipelines. The flaw exists in the Magick Image File Format (MIFF) decoder, where a missing input check allows a crafted MIFF file to trigger an infinite loop. Processing the malicious file drives the CPU to full utilization and exhausts host resources. The vulnerability affects ImageMagick versions prior to 7.1.2.23 and 6.9.13-48. The issue is tracked under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact

A remote attacker can submit a crafted MIFF image to any service that calls ImageMagick, causing sustained CPU exhaustion and denial of service without authentication or user interaction.

Affected Products

• ImageMagick versions prior to 7.1.2.23
• ImageMagick 6.x versions prior to 6.9.13-48
• Applications and services that invoke ImageMagick to decode MIFF format inputs

Discovery Timeline

• 2026-06-10 - CVE-2026-46522 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46522

Vulnerability Analysis

The vulnerability resides in the MIFF decoder within ImageMagick. MIFF is ImageMagick's native lossless container format that stores pixel data along with metadata describing image geometry, colorspace, and compression. The decoder parses these headers and pixel streams sequentially during image load operations.

A crafted MIFF file omits or manipulates a field that the decoder relies on to advance its parsing loop. Because the decoder does not validate the condition that terminates the loop, processing never reaches an exit state. The loop continues consuming CPU cycles indefinitely, blocking the worker thread and preventing other image operations from completing.

This class of flaw is categorized as an algorithmic denial-of-service condition. It does not corrupt memory or disclose data, but it disables the affected process or container until the operation is killed externally.

Root Cause

The root cause is a missing termination check in the MIFF decoder's parsing logic. The decoder trusts attacker-controlled values when deciding whether to continue reading, and a hostile combination of those values produces a state that the loop cannot exit. ImageMagick maintainers added the missing validation in versions 7.1.2.23 and 6.9.13-48.

Attack Vector

Exploitation requires only that a target system decode an attacker-supplied MIFF file. Common exposure paths include image upload endpoints, thumbnail generators, document converters, and email attachment scanners that pass user content to ImageMagick. The attack vector is network-accessible, requires no privileges, and needs no user interaction. Each request consumes a worker process or thread, so repeated submissions can rapidly drain capacity across an entire fleet.

No synthetic exploit code is reproduced here. Refer to the GitHub Security Advisory GHSA-7gg8-qqx7-92g5 for vendor-published technical detail.

Detection Methods for CVE-2026-46522

Indicators of Compromise

• ImageMagick worker processes (convert, magick, identify) consuming sustained 100% CPU on a single core for unusually long durations
• Image processing requests that never return a response or exceed configured timeouts repeatedly
• Inbound files with the MIFF signature (id=ImageMagick header bytes) from untrusted sources
• Spikes in load average correlated with image upload or conversion endpoint traffic

Detection Strategies

• Monitor process runtime and CPU consumption for ImageMagick binaries and alert when a single invocation exceeds a defined wall-clock threshold
• Inspect uploaded files for the MIFF magic header and flag samples submitted by unauthenticated or low-reputation sources for sandboxed analysis
• Track the version of installed libMagickCore and libMagickWand libraries across hosts to confirm patched builds are deployed

Monitoring Recommendations

• Centralize ImageMagick stderr and resource-limit logs into a SIEM or data lake to correlate timeouts with source IP and request identifiers
• Establish baselines for normal image conversion duration per format and alert on outliers, particularly for MIFF inputs
• Track web application gateway metrics for request queue depth and worker saturation on endpoints that invoke image processing

How to Mitigate CVE-2026-46522

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2.23 or 6.9.13-48 or later on all hosts that decode untrusted images
• Inventory containers, serverless functions, and third-party appliances that embed ImageMagick and apply vendor updates as they ship
• Enforce strict per-process CPU and wall-clock limits on ImageMagick invocations using policy.xml resource directives
• Restrict the MIFF decoder in policy.xml if MIFF processing is not required by the application

Patch Information

ImageMagick maintainers fixed the missing decoder check in versions 7.1.2.23 (7.x branch) and 6.9.13-48 (6.x branch). Patch details and the full vendor advisory are available in the ImageMagick GitHub Security Advisory GHSA-7gg8-qqx7-92g5. Rebuild any application containers that bundle ImageMagick statically and redeploy after the upgrade.

Workarounds

• Disable the MIFF coder in ImageMagick policy.xml when patching cannot be performed immediately
• Apply <policy domain="resource" name="time" value="30"/> and similar CPU limits to terminate runaway decode operations
• Validate file types at the application layer and reject MIFF uploads from untrusted sources until the patch is deployed
• Run ImageMagick inside a sandbox or cgroup-constrained container with hard CPU quotas to contain resource exhaustion

# Example policy.xml additions to constrain ImageMagick processing
# Place inside the <policymap> element
<policy domain="coder" rights="none" pattern="MIFF" />
<policy domain="resource" name="time" value="30" />
<policy domain="resource" name="memory" value="256MiB" />
<policy domain="resource" name="map" value="512MiB" />