CVE-2026-48733

Vulnerability

An infinite loop vulnerability exists in the subimage-search operation within ImageMagick, a widely used image manipulation software. This issue affects versions prior to 6.9.13-49 and 7.1.2-24. The vulnerability is triggered when processing a specially crafted image file [1].

Exploitation

An attacker can exploit this vulnerability by providing a crafted image file to an application that uses a vulnerable version of ImageMagick. No specific privileges or user interaction are mentioned as requirements for exploitation in the available references [1].

Impact

Successful exploitation of this vulnerability can lead to a denial of service by causing an infinite loop, consuming system resources and making the affected application or service unavailable. The exact scope and privilege level of the impact are not detailed in the provided references [1].

Mitigation

This vulnerability has been patched in ImageMagick versions 6.9.13-49 and 7.1.2-24. Users are advised to upgrade to these fixed versions or later to mitigate the risk [1].