PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48733 ImageMagick CVE debrief

CVE-2026-48733 is a medium-severity vulnerability in ImageMagick, a free and open-source software for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in the subimage-search operation can happen when using a crafted image. This issue has been patched in versions 6.9.13-49 and 7.1.2-24.

Vendor
ImageMagick
Product
Unknown
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of ImageMagick, particularly those who process untrusted images, should update to versions 6.9.13-49 or 7.1.2-24 to mitigate this vulnerability.

Technical summary

The vulnerability is caused by an infinite loop in the subimage-search operation of ImageMagick. This can be triggered by a crafted image, potentially leading to a denial-of-service (DoS) attack. The CVSS score for this vulnerability is 4.7, indicating a medium severity.

Defensive priority

Medium

Recommended defensive actions

  • Update ImageMagick to version 6.9.13-49 or 7.1.2-24 or later.
  • Avoid processing untrusted images with ImageMagick.

Evidence notes

The CVE-2026-48733 vulnerability was published on [cve-org] and additional details can be found on [nvd].

Official resources

CVE-2026-48733 was published on 2026-06-10T23:16:49.083Z and modified on 2026-06-11T18:44:48.673Z.