CVE-2026-26283
CVE-2026-26283 · ImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent`
This page contains facts from public vulnerability sources. Check the original advisory before updating.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVSS 6.2 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
imagemagick
- Versions
- >= 7.0.0, < 7.1.2-15: Affected
- < 6.9.13-40: Affected
No fix published
imagemagick Debian:12
- Versions
- 8:6.9.11.60+dfsg-1.6
- 8:6.9.11.60+dfsg-1.6+deb12u1
- 8:6.9.11.60+dfsg-1.6+deb12u2
- 8:6.9.11.60+dfsg-1.6+deb12u3
- 8:6.9.11.60+dfsg-1.6+deb12u4
- 8:6.9.11.60+dfsg-1.6+deb12u5
- 8:6.9.11.60+dfsg-1.6+deb12u6
- Affected ranges
- ECOSYSTEM: < 8:6.9.11.60+dfsg-1.6+deb12u7
Update to 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick Debian:13
- Versions
- 8:7.1.1.43+dfsg1-1
- 8:7.1.1.43+dfsg1-1+deb13u1
- 8:7.1.1.43+dfsg1-1+deb13u2
- 8:7.1.1.43+dfsg1-1+deb13u3
- 8:7.1.1.43+dfsg1-1+deb13u4
- 8:7.1.1.43+dfsg1-1+deb13u5
- Affected ranges
- ECOSYSTEM: < 8:7.1.1.43+dfsg1-1+deb13u6
Update to 8:7.1.1.43+dfsg1-1+deb13u6
imagemagick Debian:14
- Versions
- 8:7.1.1.43+dfsg1-1
- 8:7.1.1.46+dfsg1-1
- 8:7.1.1.47+dfsg1-1
- 8:7.1.1.47+dfsg1-2
- 8:7.1.2.1+dfsg1-1
- 8:7.1.2.12+dfsg1-1
- 8:7.1.2.13+dfsg1-1
- 8:7.1.2.3+dfsg1-1
- 8:7.1.2.7+dfsg1-1
- 8:7.1.2.8+dfsg1-1
- Affected ranges
- ECOSYSTEM: < 8:7.1.2.15+dfsg1-1
Update to 8:7.1.2.15+dfsg1-1
imagemagick Ubuntu:25.10
- Versions
- 8:7.1.1.43+dfsg1-1
- 8:7.1.1.43+dfsg1-1ubuntu1
- 8:7.1.1.43+dfsg1-1ubuntu2
- 8:7.1.2.3+dfsg1-1
- 8:7.1.2.3+dfsg1-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published