CVE-2026-53464: ImageMagick Memory Leak in Wand Option Parser—MEDIUM Severity

Technical summary

CVE-2026-53464 is a memory leak vulnerability in ImageMagick's wand option parser. When malformed or invalid options are passed to the parser, the application fails to properly deallocate memory before returning an error. The vulnerability is classified under CWE-401 (Missing Release of Memory after Effective Lifetime). The attack vector is local with no privilege escalation required, no user interaction, and no impact to confidentiality or integrity—only availability through resource exhaustion.

Business impact

The primary risk is denial of service through repeated memory exhaustion. In environments where ImageMagick processes untrusted image files or user-supplied conversion requests, an attacker could craft malicious invocations to gradually consume available RAM. On resource-constrained systems (embedded servers, containerized environments, or shared hosting), this could force application restarts or system instability. For most organizations, this is a moderate operational concern rather than a critical breach risk.

Affected systems

ImageMagick versions prior to 7.1.2-25 are vulnerable. This includes the stable 7.1.2 branch and all earlier releases. Systems using ImageMagick for automated image processing—particularly those exposed to user uploads or external image sources—warrant priority assessment. Debian, Ubuntu, Red Hat, and other Linux distributions that package ImageMagick should be checked for their patched version availability.

Exploitability

The vulnerability requires local code execution or the ability to invoke ImageMagick with attacker-controlled options. It is not a network-exploitable remote code execution vulnerability. An attacker would need shell access or the ability to submit crafted image processing requests to a service running ImageMagick. The repeated nature of the leak (small per-invocation, cumulative over time) makes it suitable for low-and-slow denial-of-service attacks that may evade immediate detection.

Remediation

Upgrade ImageMagick to version 7.1.2-25 or later. Verify the version via `identify -version` or `magick -version`. For systems using package managers, check availability of the patched version in your distribution's repository; updates may lag the upstream release. In the interim, implement input validation and rate limiting on image processing endpoints to mitigate resource exhaustion risk.

Patch guidance

Apply the upgrade to version 7.1.2-25 as soon as feasible. Most Linux distributions will eventually ship this update; check your package manager's advisory listings. Compile from source if needed: download from imagemagick.org and build with `./configure && make && sudo make install`. Verify the patched version is in use post-deployment. For containerized deployments, update base image references and rebuild containers.

Detection guidance

Monitor system memory usage during ImageMagick operations. Track RSS/heap growth over successive image conversions, especially when processing untrusted inputs. Observe application error logs for repeated 'invalid option' messages or parsing failures. Memory profiling tools (valgrind, massif) can confirm the leak in test environments. On production systems, alert on sustained memory growth without corresponding process termination.

Why prioritize this

This vulnerability is MEDIUM severity (CVSS 4.0) and not listed in the CISA KEV catalog, reflecting its limited immediate exploitability and impact scope. However, it should not be overlooked in environments processing untrusted images at scale or on memory-constrained systems. Prioritize patching for internet-facing image services; deprioritize for offline or air-gapped ImageMagick use.

Risk score, explained

The CVSS 3.1 score of 4.0 (MEDIUM) reflects: local attack vector, low complexity, no privilege or user interaction required, and limited availability impact. The lack of confidentiality or integrity compromise keeps the score moderate. For organizations with large-scale image processing or those accepting arbitrary user inputs, the cumulative risk may warrant higher internal priority than the baseline score suggests.

Frequently asked questions