CVE-2026-53462

Analyzed Analyzed - Analysis Complete

Heap Use After Free in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-53462

EUVD

EUVD-2026-36189

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-50 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, if an allocation fails in the CheckPrimitiveExtent function, it can cause a heap-use-after-free condition. This means that the software may attempt to use memory that has already been freed, which can lead to a crash.

Impact Analysis

The vulnerability can cause ImageMagick to crash due to a heap-use-after-free error when an allocation fails in CheckPrimitiveExtent. This can lead to denial of service by making the software unstable or unusable during image processing.

Mitigation Strategies

To mitigate this vulnerability, update ImageMagick to version 6.9.13-50 or later, or 7.1.2-25 or later, where the issue has been patched.

Compliance Impact

This vulnerability in ImageMagick results in a heap-use-after-free condition that can cause application crashes, impacting system availability.

The vulnerability does not affect confidentiality or integrity of data, which are critical factors for compliance with standards such as GDPR and HIPAA.

Therefore, while the vulnerability may affect system availability, it does not directly compromise personal data or protected health information, and thus has limited impact on compliance with these regulations.

Hi! I’m here to help you understand CVE-2026-53462. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70