CVE-2026-53464

Analyzed Analyzed - Analysis Complete

Memory Leak in ImageMagick Due to Invalid Wand Options

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, when providing invalid options to the wand option parser a small memory leak will occur. This issue has been patched in version 7.1.2-25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-53464

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 7.1.2-25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Detection Guidance

This vulnerability is a memory leak in the wand option parser of ImageMagick versions prior to 7.1.2-25, triggered by providing invalid arguments. Detection involves verifying the installed ImageMagick version to see if it is older than 7.1.2-25.

To detect if your system is vulnerable, you can check the ImageMagick version using the following command:

magick -version

If the version is earlier than 7.1.2-25, your system is potentially vulnerable. Additionally, monitoring for unusual memory usage or leaks when running ImageMagick commands with invalid options might help identify exploitation attempts, but no specific detection commands for the memory leak are provided.

Executive Summary

This vulnerability in ImageMagick occurs when invalid options are provided to the wand option parser, causing a small memory leak. It affects versions prior to 7.1.2-25 and has been fixed in that version.

Impact Analysis

The impact of this vulnerability is limited to a small memory leak, which could potentially degrade system performance or stability over time if exploited. However, it does not affect confidentiality, integrity, or availability directly.

Compliance Impact

This vulnerability does not impact confidentiality or integrity of data, so it is unlikely to directly affect compliance with standards such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should update ImageMagick to version 7.1.2-25 or later, where the memory leak issue has been patched.

Hi! I’m here to help you understand CVE-2026-53464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70