CVE-2026-106565 in ImageMagick
Summary
by MITRE • 10/07/2026
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
ImageMagick serves as a widely deployed, free, and open-source software suite designed for the editing, conversion, and manipulation of digital images across various formats. Its ubiquity in web applications, content management systems, and automated image processing pipelines makes it a critical component in many modern IT infrastructures. The vulnerability identified affects versions prior to 7.1.2-32 and 6.9.13-57, specifically targeting the internal handling of bzip2-compressed image data during the decoding process. This flaw represents a significant reliability risk for services that accept user-supplied images or perform automated batch processing involving compressed formats.
The core technical deficiency lies in the absence of an end-of-file check when parsing bzip2 streams within ImageMagick's decoder logic. When the software encounters malformed, truncated, or specifically crafted bzip2-compressed data, it fails to properly detect the termination condition of the compression stream. Instead of gracefully handling the incomplete data and returning an error code, the internal loop continues indefinitely in a state where no new valid bytes are being processed but the control flow does not exit. This behavior is classified under CWE-835, which describes logic errors that result in infinite loops or re-entry vulnerabilities. The lack of boundary validation allows an attacker to trigger this condition by uploading a maliciously crafted image file with invalid bzip2 headers or truncated payloads.
The operational impact of this vulnerability is primarily centered on resource exhaustion and denial of service conditions. Because the processing loop runs infinitely, it consumes CPU cycles continuously without releasing system resources associated with that specific thread or process instance. In environments where ImageMagick operates as a daemon or within web application backends handling concurrent requests, such an event can lead to rapid depletion of available computational capacity. This effectively results in a denial-of-service scenario for the affected service, potentially causing timeouts, crashes, or cascading failures if other dependent services rely on timely responses from the image processing component. The severity is heightened by the fact that bzip2 compression is commonly used in formats like TIFF and others supported by ImageMagick, increasing the attack surface against applications that process diverse media types.
Mitigation strategies must prioritize immediate version upgrades to address this logic flaw directly. Organizations utilizing ImageMagick should upgrade to version 7.1.2-32 or later for the stable branch, or version 6.9.13-57 and above if maintaining legacy compatibility is required. These releases include the necessary code changes to implement proper end-of-file detection within the bzip2 decoder, ensuring that malformed streams are rejected rather than processed indefinitely. In addition to software updates, defensive measures should be implemented at the network or application layer. Input validation mechanisms can be employed to restrict accepted file types and verify integrity before passing data to ImageMagick libraries. Furthermore, deploying resource limits such as CPU time quotas for image processing tasks can mitigate the impact of any remaining unpatched instances by preventing a single malicious request from monopolizing system resources indefinitely.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1496, which covers Resource Hijacking through denial-of-service methods that exhaust computational or storage resources. Attackers may leverage such flaws in conjunction with other vectors to disrupt service availability without necessarily gaining unauthorized access to data. Security teams should monitor for unusual spikes in CPU usage associated with image processing services and review logs for repeated failures in decoding compressed formats, which could indicate active exploitation attempts targeting this specific logic error.