Security researchers have found that a specially crafted image file can cause ImageMagick to loop forever, pinning a CPU core at 100 percent until the process is killed. Tracked as CVE-2026-46522, the vulnerability affects the MIFF image decoder and requires almost no effort to exploit.
The bug is in coders/miff.c, specifically in the BZip2 decompression branch. When the per-block compressed length prefix is set to zero, the BZ2_bzDecompress function returns BZ_OK silently, and the loop only exits on BZ_STREAM_END. Since that condition never arrives, the decoder spins forever. The LZMA and Zip branches don’t have this problem because their decompressors reject empty input.
The proof-of-concept file is just 224 bytes. Trigger it with any ImageMagick operation that reads the file — even something as simple as magick identify — and the process hangs, consuming an entire CPU core. It’ll keep going until a timeout kills it or someone manually intervenes.
This is especially dangerous in web applications that accept user-uploaded images and process them server-side with ImageMagick. An attacker can upload the tiny MIFF file and peg every available worker process, denying service to legitimate requests. Docker containers running ImageMagick are particularly vulnerable because the loop will eat into the shared CPU allocation.
The fix is straightforward: update ImageMagick to a patched version. If you can’t update immediately, consider validating uploaded files before passing them to ImageMagick, or switching to a different image processing library like libvips for upload handling.
