CVE-2026-48733 describes an infinite loop vulnerability in the subimage-search feature of Magick.NET-Q16-AnyCPU. When a specially crafted image is processed, the operation may enter an infinite loop, leading to denial of service by exhausting processing resources. The vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition). It has a CVSS 3.1 vector indicating local attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact. No known exploits are reported in the wild. No official patch or remediation guidance is provided in the available data.

Successful exploitation results in a denial of service condition due to an infinite loop, causing the affected application to hang or become unresponsive. There is no direct impact on confidentiality or integrity. The vulnerability requires local access and user interaction, with high attack complexity limiting exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or suspicious images with the subimage-search operation in affected versions. Monitor for vendor updates regarding patches or official mitigations.