CVE-2026-46522

What it actually does

CVE-2026-46522 is a denial-of-service vulnerability in ImageMagick's MIFF image decoder. A missing validation check allows a specially crafted MIFF file to trigger an infinite loop during image parsing, consuming CPU resources indefinitely. Because ImageMagick is commonly used in automated image-processing pipelines, web upload handlers, thumbnail generators, document conversion workflows, and media services, exploitation can occur wherever untrusted image files are processed. The flaw does not provide code execution, data disclosure, or direct privilege escalation, but it can cause high availability impact by exhausting CPU on affected systems.

Why it matters to the business

Successful exploitation can make image-processing services slow, unresponsive, or unavailable, disrupting user uploads, media rendering, document conversion, content moderation, publishing workflows, and any business process that depends on ImageMagick. Internet-facing or automated systems that process files from untrusted users are at highest risk because the vulnerability requires only a crafted file to be submitted for processing. Although it is not listed in CISA KEV and is not known to be ransomware-associated, public exploit availability and a CVSS score of 7.5 make timely remediation important, especially for high-volume services where CPU exhaustion can cascade into queue backlogs, autoscaling cost spikes, or broader application outages.

How an attack unfolds

An attacker creates or obtains a malicious MIFF image designed to exercise the missing decoder check. The attacker then delivers the file to an affected ImageMagick workflow, such as a web image upload, API endpoint, email attachment processor, batch media converter, or any service that invokes ImageMagick commands or libraries against user-supplied files. When the vulnerable decoder attempts to parse the MIFF content, it enters an infinite loop and consumes CPU. Repeated submissions or concurrent processing of multiple crafted files can pin CPU cores, exhaust worker pools, increase processing queues, trigger timeouts, and ultimately deny service to legitimate users. Exploitation does not require authentication if the affected file-processing interface is publicly accessible and accepts untrusted images.

How to fix it

Upgrade ImageMagick to a fixed version: 7.1.2.23 or later for the 7.x branch, or 6.9.13-48 or later for the 6.x branch. Where ImageMagick is embedded in containers, appliances, language bindings, or downstream packages, rebuild and redeploy those components so the runtime uses the fixed ImageMagick libraries and command-line tools. If immediate upgrade is not possible, reduce exposure by blocking or disabling MIFF processing for untrusted inputs, enforcing strict file type allowlists, validating file signatures rather than relying on extensions, applying CPU and wall-clock time limits to conversion jobs, isolating image processing in sandboxed workers, limiting upload size and conversion concurrency, and using queue-level rate limiting. Remove or disable unused ImageMagick coders if supported by policy configuration, and ensure all externally reachable upload and conversion endpoints have abuse controls.

How to confirm the fix worked

Confirm installed ImageMagick versions with commands such as `magick -version`, `convert -version`, or package-manager queries, and verify they report 7.1.2.23 or later, or 6.9.13-48 or later. In containerized deployments, validate the version inside the running image, not only on the build host. Review ImageMagick policy configuration to confirm MIFF handling is disabled or restricted if that mitigation is used. Test representative upload and conversion workflows to ensure legitimate image processing still works after upgrade or policy changes. For exposure validation, inventory services that invoke ImageMagick directly or through libraries and identify any paths that process unauthenticated or untrusted files. Monitor whether crafted or malformed MIFF inputs are rejected quickly and whether conversion jobs are subject to CPU, timeout, and concurrency limits.

Typical attack path

1. Identify an application or service that accepts image files or otherwise processes user-controlled files with ImageMagick.
2. Prepare a crafted MIFF file that triggers the infinite loop in vulnerable ImageMagick versions prior to 7.1.2.23 or 6.9.13-48.
3. Submit the file through an upload form, API, email ingestion workflow, content-processing queue, or other file-processing path.
4. Allow the backend ImageMagick decoder to parse the file and enter the CPU-consuming loop.
5. Repeat submissions or submit multiple files in parallel to exhaust CPU capacity, occupy processing workers, and degrade or disrupt service availability.

How to detect it

To determine whether exploitation has already occurred, review logs from upload endpoints, API gateways, web servers, message queues, email/file ingestion systems, media-processing workers, and application error logs for MIFF file submissions followed by long-running conversions, timeouts, worker crashes, queue backlogs, or CPU saturation. Correlate suspicious file-processing events with host telemetry showing `magick`, `convert`, `identify`, or other ImageMagick-related processes consuming near-100% CPU for unusually long periods. Search for files with MIFF headers or `.miff` extensions in upload directories, temporary conversion directories, object storage staging areas, and quarantine locations. Because this is a denial-of-service issue rather than a code-execution flaw, expected artifacts are primarily resource-exhaustion indicators: repeated processing of malformed MIFF inputs, elevated CPU, job timeouts, and service unavailability around the time of file ingestion. No public KEV or ransomware association is indicated, so detection should focus on opportunistic abuse and availability-impact events rather than persistence or post-exploitation behavior.

• .miff
• MIFF
• id=ImageMagick
• magick
• convert
• identify
• stream
• CPU time limit exceeded
• resource temporarily unavailable
• operation timed out
• conversion timed out
• image processing timeout
• delegate failed
• cache resources exhausted
• no decode delegate for this image format
• miff.c
• MIFF decoder

What your security team should do

• Prioritize upgrading all ImageMagick installations that process untrusted or internet-submitted files to 7.1.2.23, 6.9.13-48, or later.
• Inventory applications, containers, serverless functions, batch jobs, and third-party components that invoke ImageMagick or depend on ImageMagick libraries.
• Apply defense-in-depth controls for media processing, including strict file allowlists, upload rate limits, conversion timeouts, CPU quotas, sandboxing, and worker isolation.
• Temporarily disable MIFF decoding for untrusted inputs if upgrade cannot be completed promptly.
• Add monitoring for abnormal CPU saturation, long-running ImageMagick processes, repeated conversion timeouts, and spikes in failed or malformed image-processing jobs.
• Review web, API, queue, and application logs for suspicious MIFF uploads or repeated image-processing failures since the vulnerability was published.
• Ensure container base images and downstream packages are rebuilt and redeployed so fixed ImageMagick binaries are actually in production runtimes.