CVE-2026-55595

What it actually does

This flaw causes ImageMagick to enter an infinite loop when the connected-components option is invoked with invalid arguments. The impact is availability-only: a malicious or malformed invocation can consume CPU indefinitely, hang an image-processing worker, and potentially exhaust processing capacity if repeated. The vulnerability does not directly provide code execution, privilege escalation, data disclosure, or data modification. Exploitation requires the attacker to influence how ImageMagick is invoked, particularly command-line options or application-controlled processing parameters, which makes the attack more situational than file-only image parsing vulnerabilities.

Why it matters to the business

Organizations that use ImageMagick in upload pipelines, media conversion services, document workflows, thumbnail generation, or batch image-processing jobs could experience hung jobs, degraded service, worker pool exhaustion, higher infrastructure cost, or temporary denial of image-related functionality. The current risk is moderated by low CVSS severity, very low EPSS, no known CISA KEV listing, no known ransomware association, and no reported exploit maturity; however, internet-facing services that allow users to influence ImageMagick processing parameters should treat this as more urgent because repeated hangs can create operational outages.

How an attack unfolds

An attacker first identifies an application, script, or local workflow that invokes ImageMagick and allows some control over processing options. Instead of relying only on image content, the attacker needs the vulnerable connected-components option to be called with invalid arguments. They then submit input, parameters, or a job request that causes ImageMagick to execute that malformed option. On vulnerable versions prior to 6.9.13-51 or 7.1.2-26, ImageMagick can enter an infinite loop. If the application lacks execution timeouts, worker recycling, CPU limits, or queue controls, the affected process remains stuck and consumes resources. Repeating the request can tie up additional workers and degrade or deny the service that depends on ImageMagick.

How to fix it

Upgrade ImageMagick to a fixed release: 6.9.13-51 or later for the 6.x branch, or 7.1.2-26 or later for the 7.x branch. Ensure the fix is applied not only to operating system packages but also to bundled, containerized, statically packaged, or application-vendored ImageMagick binaries. Where immediate upgrade is not possible, reduce exposure by preventing untrusted users from controlling ImageMagick options, rejecting or normalizing connected-components parameters, disabling workflows that expose that option, enforcing strict execution timeouts, limiting CPU and memory per job, using queue back-pressure, and recycling hung workers. For services that process untrusted uploads, run ImageMagick in a constrained sandbox or container with resource limits and least privileges.

How to confirm the fix worked

Confirm the installed ImageMagick version with package metadata and runtime checks such as `magick -version`, `convert -version`, or the relevant package manager query. Systems should report ImageMagick 6.9.13-51 or later, or 7.1.2-26 or later, depending on the deployed branch. Validate containers and application bundles separately because they may carry their own ImageMagick binary independent of the host. Review application code and job definitions to confirm untrusted users cannot pass arbitrary ImageMagick options. In a controlled non-production environment, verify that malformed connected-components usage is rejected, exits safely, or is terminated by a timeout rather than hanging indefinitely. Confirm operational controls such as process timeouts, worker health checks, and CPU limits are active.

Typical attack path

1. Identify an application or workflow that uses ImageMagick for image analysis, conversion, thumbnailing, or media processing.
2. Determine whether user input can influence ImageMagick command-line options or processing parameters, especially connected-components.
3. Submit a malformed job or request that causes ImageMagick to invoke connected-components with invalid arguments.
4. Cause the vulnerable ImageMagick process to enter an infinite loop and remain running.
5. Repeat the action to exhaust worker threads, job queues, CPU capacity, or container resources, resulting in degraded service or denial of service.

How to detect it

There are no reliable public indicators that uniquely prove exploitation of this issue. Detection should focus on evidence of attempted or successful denial-of-service behavior in ImageMagick-based workflows. Review application, web, job queue, container, EDR, and process execution logs for ImageMagick invocations using `connected-components`, especially with unusual or invalid arguments. Look for long-running or stuck `magick` or `convert` processes, high CPU consumption without job completion, repeated worker timeouts, queue growth, container restarts, health-check failures, and bursts of requests that trigger the same image-processing path. Correlate suspicious requests with process telemetry showing ImageMagick processes that exceed normal runtime baselines. If command-line logging is available, prioritize searches for `-connected-components` in process command lines. For forensic review, examine scheduler/job metadata, web access logs, application error logs, and container stdout/stderr around periods of elevated CPU or image-processing outages.

• -connected-components
• connected-components
• magick -version
• convert -version
• process_name=magick
• process_name=convert
• ImageMagick
• MagickCore
• MagickWand

What your security team should do

• Inventory all ImageMagick deployments, including host packages, containers, serverless images, CI/CD build images, and application-vendored binaries.
• Prioritize upgrades for internet-facing or multi-tenant services where users can influence image-processing options or submit processing jobs at scale.
• Upgrade to ImageMagick 6.9.13-51 or later, or 7.1.2-26 or later, and rebuild/redeploy dependent images and applications.
• Add or verify execution timeouts, CPU limits, job queue limits, and worker recycling for all ImageMagick processing of untrusted content.
• Audit application code for unsafe construction of ImageMagick command lines, especially user-controlled use of `-connected-components`.
• Monitor for long-running `magick`, `convert`, or related ImageMagick processes and repeated image-processing job timeouts.
• Because this is not listed in KEV, has no known ransomware use, and has very low EPSS, handle through normal patch management unless exposure is internet-facing or option control is delegated to untrusted users.