CVE-2026-46522
Published: 10 June 2026
Summary
CVE-2026-46522 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 31.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
ImageMagick, the open-source image editing and manipulation software, is affected by CVE-2026-46522 in all versions prior to 7.1.2.23 and 6.9.13-48. The root cause is a missing bounds or termination check inside the MIFF decoder that allows a specially crafted input file to trigger an infinite loop, classified under CWE-400 and CWE-835 and resulting in sustained CPU exhaustion.
An unauthenticated remote attacker can exploit the flaw simply by causing the vulnerable ImageMagick instance to process the malicious MIFF file, whether delivered over the network or read from local storage. Successful exploitation produces a denial-of-service condition with high impact on availability but no confidentiality or integrity loss, consistent with the CVSS 7.5 rating.
The referenced GitHub Security Advisory GHSA-7gg8-qqx7-92g5 states that the issue is resolved by upgrading to the patched releases 7.1.2.23 or 6.9.13-48, which introduce the missing validation logic in the MIFF decoder. The associated EPSS score has remained flat at 0.0106 with no observable increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-36162
Vulnerability details
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion.…
more
Versions 7.1.2.23 and 6.9.13-48 fix the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Alternate site allows resumption of operations if resource exhaustion at the primary site is exploited to cause unavailability.
Directly limits uncontrolled resource consumption that leads to denial-of-service.
Limiting concurrent sessions directly prevents uncontrolled resource consumption by capping the number of active sessions per user or account.
Analysis identifies uncontrolled resource consumption indicative of denial-of-service or abuse attempts.
Contingency plan testing includes resource exhaustion scenarios to verify recovery, making it harder for attackers to sustain exploits that cause uncontrolled consumption.
Updated contingency plans include current procedures to detect, contain, and recover from resource exhaustion, limiting an attacker's ability to sustain impact from uncontrolled consumption.
Alternate telecommunications services enable resumption of essential functions when primary services become unavailable due to uncontrolled resource consumption.
The team can analyze and respond to resource exhaustion incidents, reducing the impact of attacks that exploit uncontrolled consumption weaknesses.