CVE-2026-48733: ImageMagick DOS Vulnerability

CVE-2026-48733 Overview

CVE-2026-48733 is an infinite loop vulnerability in ImageMagick, the open-source image editing and manipulation library. The flaw resides in the subimage-search operation and triggers when ImageMagick processes a specially crafted image. An attacker who can supply input to a vulnerable ImageMagick instance can cause the process to enter a non-terminating loop, exhausting CPU resources and resulting in a denial of service on the host. The issue is tracked under [CWE-835] (Loop with Unreachable Exit Condition). Maintainers have patched the defect in ImageMagick 6.9.13-49 and 7.1.2-24.

Critical Impact

A crafted image submitted to the subimage-search operation causes ImageMagick to loop indefinitely, consuming CPU and denying service to applications that rely on the library.

Affected Products

• ImageMagick versions prior to 6.9.13-49 (6.x branch)
• ImageMagick versions prior to 7.1.2-24 (7.x branch)
• Applications and services that embed vulnerable ImageMagick builds for image processing

Discovery Timeline

• 2026-06-10 - CVE-2026-48733 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-48733

Vulnerability Analysis

The defect is classified as [CWE-835], a loop with an unreachable exit condition. ImageMagick's subimage-search functionality scans a larger image for occurrences of a smaller reference image. When a malformed or adversarially constructed image is passed to this operation, the search routine fails to satisfy its termination condition and continues iterating without progress. The process remains in this loop until externally terminated, blocking the worker that handles the request and consuming a full CPU core.

The vulnerability requires local access and user interaction, and the impact is limited to availability. Confidentiality and integrity are not affected. The high attack complexity reflects the need to craft an image whose properties drive the search algorithm into the looping state.

Root Cause

The root cause is missing or incorrect bounds and progress checks in the subimage-search code path. The loop control logic does not account for input geometries or pixel patterns that prevent the search from converging, so the exit predicate is never satisfied. The maintainers corrected this in the patched releases by tightening the iteration constraints in the subimage-search implementation.

Attack Vector

An attacker delivers a crafted image to any workflow that invokes ImageMagick's subimage-search operation. This typically occurs through a command-line magick or convert invocation, a scripted pipeline, or an application binding such as MagickWand or Imagick. When the user or service processes the image, the worker enters the infinite loop and becomes unresponsive. Repeated submissions can exhaust pooled workers and degrade the entire host. See the ImageMagick GitHub Security Advisory GHSA-5v62-8fq6-cp9m for technical details.

Detection Methods for CVE-2026-48733

Indicators of Compromise

• ImageMagick processes (magick, convert, identify) sustaining 100% CPU on a single core for extended periods without producing output.
• Image processing jobs that never complete and exceed configured timeouts on hosts running pre-patch ImageMagick versions.
• Repeated submissions of unusual or malformed images followed by stalled worker processes.

Detection Strategies

• Inventory ImageMagick installations across endpoints, containers, and build systems and compare versions against 6.9.13-49 and 7.1.2-24.
• Monitor process telemetry for long-running ImageMagick child processes and correlate with image-processing job queues.
• Enable ImageMagick policy logging and review entries for subimage-search invocations on untrusted inputs.

Monitoring Recommendations

• Alert on ImageMagick worker processes that exceed CPU-time or wall-clock thresholds defined for normal jobs.
• Track failure rates and timeouts in image upload and processing services, especially user-facing endpoints.
• Capture and retain samples of input images that trigger worker timeouts for offline analysis.

How to Mitigate CVE-2026-48733

Immediate Actions Required

• Upgrade ImageMagick to 6.9.13-49 or 7.1.2-24 (or later) on all affected systems.
• Apply distribution package updates as soon as vendors publish backported builds.
• Enforce per-process CPU and wall-clock limits on ImageMagick workers to bound the impact of looping operations.

Patch Information

The ImageMagick maintainers fixed the vulnerability in releases 6.9.13-49 and 7.1.2-24. Patch details and commit references are available in the ImageMagick GitHub Security Advisory GHSA-5v62-8fq6-cp9m. Rebuild any applications that statically link ImageMagick after updating the library.

Workarounds

• Disable or restrict the subimage-search operation in environments that do not require it by adjusting the ImageMagick policy.xml resource limits.
• Set strict resource policies for time, memory, and thread in policy.xml so that runaway operations are terminated automatically.
• Reject or sanitize untrusted images at the application boundary before passing them to ImageMagick.

# Example policy.xml hardening to bound ImageMagick operations
# Place in /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml
<policymap>
  <policy domain="resource" name="time"   value="30"/>
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="thread" value="2"/>
  <!-- Disable subimage-search if not required by the workload -->
  <policy domain="coder" rights="none" pattern="SUBIMAGE-SEARCH"/>
</policymap>