CVE-2026-26066
📋 TL;DR
ImageMagick versions before 7.1.2-15 and 6.9.13-40 contain a vulnerability where specially crafted IPTC profile data can trigger an infinite loop when processed with the IPTCTEXT function. This affects any system or application using vulnerable ImageMagick versions to process images, potentially causing denial of service. The vulnerability is in the image processing library itself, so any software using ImageMagick could be impacted.
💻 Affected Systems
- ImageMagick
📦 What is this software?
Imagemagick by Imagemagick
Imagemagick by Imagemagick
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through resource exhaustion - an attacker could cause ImageMagick processes to hang indefinitely, consuming CPU and memory until manual intervention.
Likely Case
Service disruption where image processing operations fail or become unresponsive, affecting applications that rely on ImageMagick for image manipulation.
If Mitigated
Minimal impact with proper input validation and resource limits in place, though some processing delays may still occur.
🎯 Exploit Status
Exploitation requires creating or modifying an image with malicious IPTC data, which requires some technical knowledge of IPTC format. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.2-15 and 6.9.13-40
Vendor Advisory: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3
Restart Required: Yes
Instructions:
1. Identify current ImageMagick version using 'convert --version' or 'magick --version'
2. For systems using package managers: Update via 'apt-get update && apt-get upgrade imagemagick' (Debian/Ubuntu) or 'yum update imagemagick' (RHEL/CentOS)
3. For source installations: Download latest version from ImageMagick.org and recompile
4. Restart any services or applications using ImageMagick
🔧 Temporary Workarounds
Disable IPTC profile processing
allConfigure ImageMagick to ignore or strip IPTC metadata during image processing
convert input.jpg -strip output.jpg
magick input.jpg -strip output.jpg
Implement resource limits
linuxSet CPU and memory limits on ImageMagick processes to prevent complete resource exhaustion
ulimit -t 30 (limits CPU time to 30 seconds)
ulimit -v 1000000 (limits virtual memory to 1GB)
🧯 If You Can't Patch
- Implement strict input validation to reject or sanitize images with IPTC metadata before processing
- Deploy ImageMagick in containerized environments with strict resource limits and automatic restart policies
🔍 How to Verify
Check if Vulnerable:
Check ImageMagick version: 'convert --version' or 'magick --version' and compare against vulnerable versions (before 7.1.2-15 or 6.9.13-40)Check Version:
convert --version 2>/dev/null || magick --version 2>/dev/null || echo 'ImageMagick not found'Verify Fix Applied:
After updating, verify version shows 7.1.2-15 or higher, or 6.9.13-40 or higher. Test with known safe images containing IPTC data.📡 Detection & Monitoring
Log Indicators:
- ImageMagick processes consuming 100% CPU for extended periods
- Image processing timeouts or failures in application logs
- High memory usage by ImageMagick processes
Network Indicators:
- Increased failed image uploads or processing requests
- Unusual patterns of image file uploads to web applications
SIEM Query:
process_name:"convert" OR process_name:"magick" AND (cpu_usage:>90 AND duration:>60s)