CVE-2026-106565: ImageMagick: Infinite Loop in bzip2 compressed images.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-57
Event History
Frequently Asked Questions
Which ImageMagick versions need to be updated?
Update ImageMagick 7 to 7.1.2-32 or later, or ImageMagick 6 to 6.9.13-57 or later. Versions before those releases are affected.
What does an attacker need to exploit this issue?
An attacker needs to cause ImageMagick to read bzip2-compressed image data that lacks a valid end-of-file condition. The issue is remotely reachable and requires no privileges or user interaction, although exploitation has high attack complexity.
What is the impact of successful exploitation?
Processing the crafted image data can enter an infinite loop and exhaust processing resources, causing a denial of service. The provided severity data indicates no confidentiality or integrity impact.