4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48733

CVE-2026-48733: ImageMagick: Infinite Loop in subimage-search with crafted image

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in the subimage-search operation can happen when using a crafted image. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48733

CVE-2026-48733:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q16-x86	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-AnyCPU	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-arm64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x64	nuget	< 14.14.0	14.14.0
Magick.NET-Q8-x86	nuget	< 14.14.0	14.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by investigating the provided security advisory GHSA-5v62-8fq6-cp9m, which describes an infinite loop vulnerability in ImageMagick's subimage-search operation. The advisory pointed to patched versions 7.1.2-24 and 6.9.13-49. By comparing the git tags for versions 7.1.2-23 and 7.1.2-24 of the ImageMagick repository, a specific commit (3a12d63368e88350ed838966fcbb67625938cf3a) was identified with a commit message directly referencing the advisory. Analyzing this commit revealed a change in the SimilarityImage function within the MagickCore/compare.c file. The patch modifies the arguments to the CloneImage function, correcting the calculation of the output image dimensions. This incorrect dimension calculation is the root cause of the infinite loop when processing a crafted image. Therefore, the SimilarityImage function is the vulnerable function.

Vulnerable functions

SimilarityImage

MagickCore/compare.c

The vulnerability lies in the `SimilarityImage` function, where the dimensions for the `similarity_image` were not calculated correctly. The original code cloned the image with its original dimensions, which, when combined with a crafted subimage for reconstruction, could lead to an infinite loop during the subimage search operation. The patch corrects the dimensions of the cloned image to `image->columns-reconstruct->columns+1` and `image->rows-reconstruct->rows+1`, preventing the infinite loop.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.