CVE-2026-106565

A flaw was found in ImageMagick. A remote attacker could trigger a Denial of Service (DoS) by providing a specially crafted bzip2-compressed image file. Due to a missing End-of-File (EOF) check during image decompression, the application can enter an infinite loop, exhausting system resources and becoming unresponsive.

This vulnerability is rated as Moderate because exploitation leads to resource consumption and denial of service via an infinite loop, without allowing arbitrary code execution or confidentiality loss. ImageMagick is typically used for image processing tasks and web backend conversions, limiting the attack surface to services that process untrusted user-supplied image files. In typical command-line workflows, the impact is confined to the specific user invocation and does not grant elevated privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.