7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46522

CVE-2026-46522: ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46522

CVE-2026-46522:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-HDRI-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q16-x86	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-AnyCPU	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-OpenMP-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-arm64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x64	nuget	< 14.13.1	14.13.1
Magick.NET-Q8-x86	nuget	< 14.13.1	14.13.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an infinite loop in the MIFF decoder of ImageMagick. By analyzing the provided information and the commit history of the ImageMagick repository, I was able to pinpoint the exact commit that patches this vulnerability. The commit e8431d4a282013851cb698fdf29b1d7ad80ad7cb contains changes to the coders/miff.c file, specifically in the ReadMIFFImage function. The patch introduces a check for a zero-length data chunk during the decompression process for BZIP, LZMA, and ZLIB compressed data. This confirms that the ReadMIFFImage function was the source of the infinite loop vulnerability. A crafted MIFF file with a zero-length compressed data segment would cause the decompression loop to execute indefinitely, leading to a denial-of-service through CPU exhaustion. Therefore, the ReadMIFFImage function is the vulnerable function that would appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

ReadMIFFImage

coders/miff.c

The vulnerability lies in the `ReadMIFFImage` function in `coders/miff.c`. Specifically, the function is vulnerable to an infinite loop when processing compressed MIFF image data (BZIP, LZMA, or ZLIB). Before the patch, the code did not check if the `length` of the compressed data read from the input was zero. A crafted MIFF file could provide a zero-length data chunk, causing the decompression loop to repeat indefinitely without consuming any input, leading to 100% CPU utilization. The patch adds a check `if (length == 0)` within the decompression loops for each compression type, which properly handles this condition by throwing an error and preventing the infinite loop.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.