CVE-2026-26066

A flaw was found in ImageMagick. A local attacker could provide a crafted image profile containing invalid IPTC (International Press Telecommunications Council) data. When ImageMagick attempts to write this data using the IPTCTEXT function, it may lead to an infinite loop, resulting in a Denial of Service (DoS) for the application.

This MODERATE impact flaw in ImageMagick can lead to a denial of service. A crafted profile containing invalid IPTC data may cause an infinite loop when ImageMagick attempts to write it with IPTCTEXT. Red Hat Enterprise Linux systems utilizing ImageMagick to process untrusted image files are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict ImageMagick's processing of untrusted image files. If ImageMagick is used in an automated or server-side context, consider implementing sandboxing mechanisms to limit the resources available to the ImageMagick process when handling external input. This can help contain the impact of a denial of service.