CVE-2026-53460

Modified Modified - Updated After Analysis

Out-of-Memory Vulnerability in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-53460

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-50 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Compliance Impact

This vulnerability affects the availability of the ImageMagick service by allowing an attacker to cause a denial of service through an out-of-memory condition.

Since the vulnerability does not impact confidentiality or integrity of data, it does not directly compromise personal data protection requirements under standards like GDPR or HIPAA.

However, the denial of service could affect system availability, which is a component of these regulations, potentially impacting compliance if critical services are disrupted.

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, there was a missing check for the maximum memory request in the AcquireAlignedMemory function. This flaw could cause the software to consume excessive memory, leading to an out-of-memory condition.

Impact Analysis

The vulnerability can cause an out-of-memory condition when ImageMagick processes images, potentially leading to denial of service. This means that the affected system or application using ImageMagick could become unresponsive or crash due to excessive memory consumption.

Mitigation Strategies

To mitigate this vulnerability, you should update ImageMagick to version 6.9.13-50 or later, or version 7.1.2-25 or later, where the issue has been patched.

Detection Guidance

This vulnerability affects ImageMagick versions prior to 6.9.13-50 and 7.1.2-25. To detect if your system is vulnerable, you should first check the installed version of ImageMagick.

Run the command `convert --version` or `magick --version` to determine the installed ImageMagick version.

If the version is older than 6.9.13-50 or 7.1.2-25, your system is vulnerable to an out-of-memory denial of service attack via the AcquireAlignedMemory function.

There are no specific network detection commands or signatures provided for this vulnerability in the available resources.

Hi! I’m here to help you understand CVE-2026-53460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70