ImageMagick CVE-2026-53461

The target application must invoke ImageMagick (binary or library binding such as MagickWand, IMagick, RMagick, or Wand) to decode an attacker-supplied file that ImageMagick parses as ICON format - note that ImageMagick auto-detects format by content, so the file extension does not have to be .ico. Exploitation requires no authentication and no user interaction (PR:N/UI:N) provided the attacker can submit a file to a processing endpoint. Limiting factors: the ICON coder must not be disabled in policy.xml, and the deployed ImageMagick version must be earlier than 6.9.13-50 (6.x branch) or 7.1.2-25 (7.x branch); environments that already restrict coders via policy or use a different image library are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, 7.5 High) indicates remote, unauthenticated, low-complexity exploitation with availability-only impact - consistent with a crash rather than code execution. Although CWE-787 out-of-bounds heap writes can sometimes be escalated to RCE, the advisory explicitly characterizes the outcome as a crash, suggesting the corruption pattern is not readily controllable. No EPSS score, KEV listing, or POC indicator was provided in the intelligence feed, so real-world exploitation pressure appears low at this time. The primary risk is denial-of-service against image-processing services (thumbnail generators, upload pipelines, CMS plugins) where attackers can supply arbitrary files; for non-internet-facing image tooling the practical risk is considerably lower.

An attacker uploads a maliciously crafted ICON file to a web application that uses ImageMagick to generate thumbnails or convert avatars; when the backend invokes 'magick convert' or the MagickWand library, the ICON decoder's faulty loop writes past the heap buffer and the worker process crashes. Repeated submissions cause persistent denial of service against the image-processing pipeline, potentially exhausting worker pools or triggering supervisor restart loops. No public exploit identified at time of analysis, but a triggering ICON file is straightforward to construct given the decoder source is open.