Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-26283

Fixed in a distro release EPSS <1%CVSS 6.2

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Published 2026-02-24 · CVE record · OSV

Products: imagemagick

Fixed upstream

EcosystemPackageFixed in
NuGetMagick.NET-Q16-AnyCPU14.10.3
NuGetMagick.NET-Q16-HDRI-AnyCPU14.10.3
NuGetMagick.NET-Q16-HDRI-OpenMP-arm6414.10.3
NuGetMagick.NET-Q16-HDRI-OpenMP-x6414.10.3
NuGetMagick.NET-Q16-HDRI-arm6414.10.3
NuGetMagick.NET-Q16-HDRI-x6414.10.3
NuGetMagick.NET-Q16-HDRI-x8614.10.3
NuGetMagick.NET-Q16-OpenMP-arm6414.10.3
NuGetMagick.NET-Q16-OpenMP-x6414.10.3
NuGetMagick.NET-Q16-OpenMP-x8614.10.3
NuGetMagick.NET-Q16-arm6414.10.3
NuGetMagick.NET-Q16-x6414.10.3
NuGetMagick.NET-Q16-x8614.10.3
NuGetMagick.NET-Q8-AnyCPU14.10.3
NuGetMagick.NET-Q8-OpenMP-arm6414.10.3
NuGetMagick.NET-Q8-OpenMP-x6414.10.3
NuGetMagick.NET-Q8-arm6414.10.3
NuGetMagick.NET-Q8-x6414.10.3
NuGetMagick.NET-Q8-x8614.10.3

Distro releases

ReleasePackageFixed in
Debian 11imagemagick8:6.9.11.60+dfsg-1.3+deb11u10
Debian 12imagemagick8:6.9.11.60+dfsg-1.6+deb12u7
Debian 13imagemagick8:7.1.1.43+dfsg1-1+deb13u6
Debian 14imagemagick8:7.1.2.15+dfsg1-1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7ImageMagick7.1.1.43-150700.3.37.1
SUSE Linux Enterprise Module for Development Tools 15 SP7ImageMagick7.1.1.43-150700.3.37.1
Ubuntu 25.10imagemagickno fix
openSUSE Leap 16.0ImageMagick7.1.2.0-160000.6.1
openSUSE TumbleweedImageMagick7.1.2.15-1.1