CVE-2026-26066: Infinite Loop, Infinite Pain: Analyzing CVE-2026-26066 in ImageMagick

Infinite Loop, Infinite Pain: Analyzing CVE-2026-26066 in ImageMagick Vulnerability ID: CVE-2026-26066 CVSS Score: 6.2 Published: 2026-02-24 A logic error in ImageMagick's IPTC metadata parser allows for a trivial Denial of Service (DoS) attack. By supplying a crafted image file, an attacker can trap the processing thread in an infinite loop, causing 100% CPU utilization and potentially taking down image processing pipelines. TL;DR ImageMagick contains an infinite loop vulnerability in coders/meta.c . A malicious image with invalid IPTC data can cause the parser to get stuck reading the same byte forever, resulting in a Denial of Service. Patch immediately to 7.1.2-15 or 6.9.13-40. Technical Details CWE : CWE-835 (Infinite Loop) CVSS v3.1 : 6.2 (Medium) Attack Vector : Local (User Supplied File) Availability Impact : High (DoS) Exploit Status : Trivial / No Public PoC yet EPSS Score : 0.00013 (Low probability) Affected Systems ImageMagick 7.x < 7.1.2-15 ImageMagick 6.x < 6.9.13-40 Magi