CVE-2026-53464: ImageMagick Memory Leak Vulnerability

CVE-2026-53464 Overview

CVE-2026-53464 is a memory leak vulnerability in ImageMagick, an open-source image editing and manipulation suite. The flaw resides in the wand option parser, which fails to release allocated memory when it receives invalid options. Each malformed invocation produces a small memory leak in the affected process.

The issue affects ImageMagick releases prior to 7.1.2-25 and is fixed in version 7.1.2-25. The vulnerability requires local access and cannot be triggered remotely without an additional vector. It maps to CWE-401, Missing Release of Memory after Effective Lifetime.

Critical Impact

Repeated invocations of ImageMagick utilities with invalid wand options leak memory and can degrade availability of long-running processes that wrap the library.

Affected Products

• ImageMagick versions prior to 7.1.2-25
• Applications and services that link or invoke the ImageMagick wand interface
• Distributions packaging vulnerable ImageMagick builds

Discovery Timeline

• 2026-06-10 - CVE-2026-53464 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53464

Vulnerability Analysis

The vulnerability is a memory leak in the ImageMagick wand option parser. When the parser encounters invalid options on the command line or through the MagickWand API, it returns an error without freeing the memory it allocated while processing those options. The leaked allocation is small per call, but the leak compounds across repeated invocations.

The attack vector is local with low complexity and requires no privileges or user interaction. Confidentiality and integrity are not affected. Impact is limited to availability, manifested as gradual memory exhaustion in processes that repeatedly invoke the wand interface with malformed options.

Root Cause

The root cause is missing cleanup logic on the error path of the wand option parser. The parser allocates structures to track option state, then exits early when validation fails. The early-exit path omits the deallocation calls present on the success path, leaving the allocations referenced only by the freed parser context.

Attack Vector

A local attacker, or any process that feeds untrusted input to an ImageMagick-backed service, can trigger the leak by repeatedly passing invalid options. Web services that expose convert, mogrify, or MagickWand bindings to user-supplied parameters are the highest-risk consumers. Each request that produces a parser error contributes additional leaked memory.

No verified exploit code is published for this issue. The mechanism is described in the ImageMagick GitHub Security Advisory.

Detection Methods for CVE-2026-53464

Indicators of Compromise

• Steady growth in resident memory of processes that invoke ImageMagick utilities or link libMagickWand
• High volume of ImageMagick error log entries referencing unknown or malformed options
• Out-of-memory terminations of image processing workers without corresponding workload growth

Detection Strategies

• Inventory installed ImageMagick versions and flag any build earlier than 7.1.2-25
• Correlate per-process RSS growth with calls to convert, mogrify, identify, or MagickWand-linked services
• Review application logs for repeated wand parser errors tied to user-controlled option strings

Monitoring Recommendations

• Track memory utilization metrics for image processing services with alerting on sustained upward trends
• Capture and rate-limit ImageMagick CLI invocations originating from web request handlers
• Audit input validation layers to confirm that option strings passed to ImageMagick are constrained to an allowlist

How to Mitigate CVE-2026-53464

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-25 or later on all systems
• Restart services that link libMagickWand after upgrading to release leaked memory
• Restrict which option flags untrusted inputs may set when invoking ImageMagick

Patch Information

The ImageMagick maintainers patched the leak in release 7.1.2-25. Refer to the ImageMagick GitHub Security Advisory GHSA-j989-f892-2335 for the upstream fix details and references.

Workarounds

• Validate and sanitize option strings before passing them to ImageMagick to prevent parser errors
• Run ImageMagick in short-lived worker processes that recycle after a fixed number of requests
• Apply per-process memory limits using ulimit or container resource controls to bound leak impact