Infinite loop in ImageMagick - CVE-2026-26283

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU123261

Infinite loop in ImageMagick - CVE-2026-26283

Published: February 25, 2026


Vulnerability identifier: #VU123261
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-26283
CWE-ID: CWE-835
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in JPEG encoder when using "jpeg:extent". A local attacker can consume all available system resources and cause denial of service conditions.


Affected software

ImageMagick
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
Development Tools Module
openEuler
imagemagick (Debian package)
ImageMagick-c++-devel
ImageMagick-help
ImageMagick-perl
ImageMagick-devel
ImageMagick-debugsource
ImageMagick-debuginfo
ImageMagick-c++
ImageMagick
ImageMagick-config-7-upstream-websafe
libMagickCore-7_Q16HDRI10
libMagickWand-7_Q16HDRI10-debuginfo
libMagick++-7_Q16HDRI5-debuginfo
ImageMagick-config-7-upstream-limited
libMagick++-7_Q16HDRI5
libMagick++-devel
libMagickCore-7_Q16HDRI10-debuginfo
ImageMagick-config-7-SUSE
ImageMagick-config-7-upstream-open
ImageMagick-config-7-upstream-secure
libMagickWand-7_Q16HDRI10
perl-PerlMagick
perl-PerlMagick-debuginfo

How to mitigate CVE-2026-26283

Install updates from vendor's website.

ImageMagick - addressed in versions 6.9.13-40, 7.1.2-15
imagemagick (Debian package) - addressed in versions 8:6.9.11.60+dfsg-1.6+deb12u7, 8:7.1.1.43+dfsg1-1+deb13u6
ImageMagick-c++-devel - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-help - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-perl - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-devel - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-debugsource - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-debuginfo - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-c++ - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick - addressed in versions 6.9.13.40-1, 7.1.2.15-1
ImageMagick-config-7-upstream-websafe - update to 7.1.1.43-150700.3.37.1
libMagickCore-7_Q16HDRI10 - update to 7.1.1.43-150700.3.37.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.37.1
ImageMagick - update to 7.1.1.43-150700.3.37.1
ImageMagick-debugsource - update to 7.1.1.43-150700.3.37.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.1.43-150700.3.37.1
ImageMagick-config-7-upstream-limited - update to 7.1.1.43-150700.3.37.1
ImageMagick-debuginfo - update to 7.1.1.43-150700.3.37.1
libMagick++-7_Q16HDRI5 - update to 7.1.1.43-150700.3.37.1
libMagick++-devel - update to 7.1.1.43-150700.3.37.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.37.1
ImageMagick-config-7-SUSE - update to 7.1.1.43-150700.3.37.1
ImageMagick-devel - update to 7.1.1.43-150700.3.37.1
ImageMagick-config-7-upstream-open - update to 7.1.1.43-150700.3.37.1
ImageMagick-config-7-upstream-secure - update to 7.1.1.43-150700.3.37.1
libMagickWand-7_Q16HDRI10 - update to 7.1.1.43-150700.3.37.1
perl-PerlMagick - update to 7.1.1.43-150700.3.37.1
perl-PerlMagick-debuginfo - update to 7.1.1.43-150700.3.37.1

External References

Related Security Bulletins