CVE-2026-66011: ImageMagick Memory Leak DoS Vulnerability

CVE-2026-66011 Overview

CVE-2026-66011 is a memory leak vulnerability in ImageMagick versions prior to 7.1.2-27. The flaw resides in the magick command-line interface and triggers when invalid options are supplied. Each malformed invocation leaks memory that the process fails to release. Attackers with local access can repeatedly issue crafted commands to exhaust host memory and degrade system availability. The weakness is categorized under CWE-401: Missing Release of Memory after Effective Lifetime.

Critical Impact
Repeated invocation of the magick binary with malformed arguments causes progressive memory exhaustion, leading to denial of service on hosts that expose ImageMagick to untrusted local input or automated processing pipelines.

Affected Products

ImageMagick versions before 7.1.2-27
Systems invoking the magick CLI to process untrusted input
Automated image-processing pipelines that pass user-controlled arguments to ImageMagick

Discovery Timeline

2026-07-25 - CVE-2026-66011 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66011

Vulnerability Analysis

The vulnerability is a memory leak in ImageMagick's command-line front end. When the magick binary encounters invalid options during argument parsing, allocated memory buffers associated with the option handling path are not freed before the process exits with an error. Single invocations produce minor leaks. Repeated invocations, particularly from scripts, batch jobs, or web-facing services that spawn magick per request, allow the leaked allocations to accumulate across the parent orchestrator or long-running worker processes. The result is resource exhaustion that impairs the availability of dependent services.

Root Cause

The root cause is missing cleanup in the CLI option-parsing error path, classified as [CWE-401]. Structures allocated to represent options and parser state are not released when the parser rejects malformed input. Fixes shipped in ImageMagick 7.1.2-27 add the required deallocation calls on the error-return paths.

Attack Vector

Exploitation requires local access and some user interaction, since the attacker must trigger execution of the magick binary with attacker-controlled arguments. Realistic scenarios include multi-tenant systems, CI/CD runners, image-conversion services that expose command-line flags to remote users, and shared workstations. The attacker supplies invalid CLI options in a loop or high-frequency job to accumulate leaked memory until the system or the calling process runs out of usable memory.

No verified public exploit code is available. See the GitHub Security Advisory and the VulnCheck Advisory on ImageMagick Memory Leak for technical details.

Detection Methods for CVE-2026-66011

Indicators of Compromise

Unusually high resident memory growth in processes that invoke magick or its child processes over time.
Repeated non-zero exit codes from magick accompanied by option-parsing error messages in application logs.
Bursts of magick process spawns originating from web-facing services or shared users passing atypical flags.

Detection Strategies

Monitor per-process RSS and virtual memory for image-processing workers and alert on sustained upward trends without corresponding workload increase.
Correlate process execution telemetry with command-line arguments to identify malformed magick invocations at high frequency.
Track ImageMagick version inventory across hosts and flag any instance older than 7.1.2-27.

Monitoring Recommendations

Ingest process creation events including full command lines into a centralized logging or EDR data store for retrospective search.
Configure OS-level cgroup or ulimit memory ceilings on service accounts running ImageMagick and alert when limits are hit.
Baseline normal magick invocation patterns and alert on argument-diversity anomalies from a single caller.

How to Mitigate CVE-2026-66011

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-27 or later on all affected hosts, containers, and build images.
Restrict which users and services can invoke the magick binary, particularly on multi-tenant systems.
Validate and allowlist CLI arguments passed to ImageMagick from any application wrapping the binary.

Patch Information

The upstream fix is included in ImageMagick 7.1.2-27. Refer to the GitHub Security Advisory GHSA-cvhv-g4rq-3hmw for release details and consult distribution package feeds for backported fixes.

Workarounds

Apply per-process memory limits using ulimit -v or systemd MemoryMax on services that execute magick.
Run image processing under short-lived worker processes that recycle after a fixed number of jobs to bound accumulated leakage.
Sanitize user-supplied options against a strict allowlist before invoking the CLI, rejecting unknown flags at the application layer.

bash

# Configuration example: constrain ImageMagick memory in a systemd unit
[Service]
ExecStart=/usr/bin/magick %I
MemoryMax=512M
TasksMax=64
NoNewPrivileges=true
PrivateTmp=true