Skip to main content

ImageMagick CVE-2026-66011

| EUVDEUVD-2026-49042 MEDIUM
Memory Leak (CWE-401)
2026-07-25 VulnCheck GHSA-c28x-m839-79fq
Information Disclosure Red Hat Imagemagick Suse
4.8
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Local shell access to system
  2. Delivery
    Execute magick with malformed arguments
  3. Exploit
    Memory leak on each invocation
  4. Execution
    Repeat until memory is exhausted
  5. Impact
    System becomes unresponsive or critical processes are killed.

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions

The attacker must have local access to the system and the ability to execute the magick command. The vulnerability is triggered when a user (or attacker) intentionally provides invalid command-line options. No authentication is required at the CLI level, but the act of running the command constitutes required user interaction. Repeated execution is necessary to cause noticeable memory exhaustion.
Impact

CVSS 4.0 vector indicates a local attack with low complexity, no privileges required, but user interaction is needed to supply the malformed arguments. Only availability is impacted (VA:L). The EPSS score of 0.10% (1st percentile) predicts very low likelihood of exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known. Given the local vector and user interaction requirement, real-world risk is limited to a denial-of-service nuisance on shared systems, not a widespread threat.
Exploit ScenarioDerived

A local attacker on a multi-user system repeatedly invokes the magick command with crafted invalid options. Each invocation leaks a small amount of memory; over many runs, memory is exhausted, causing system instability or denial-of-service against other processes.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

Memory exhaustion in ImageMagick's magick CLI tool allows a local attacker to cause denial of service by repeatedly supplying malformed command-line arguments. Affects versions before 7.1.2-27. Vendor patch is available; no public exploit or active exploitation reported.

RemediationAI

Upgrade to ImageMagick 7.1.2-27 or later as per the vendor advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvhv-g4rq-3hmw. If immediate patching is not possible, restrict local access to the magick CLI to trusted users only, because the attack requires execution of the tool with user-supplied arguments.

Affected VersionsENISA

ImageMagick 0 <7.1.2-27

Affected Packages

nuget magick.net-q16-anycpu fix: 14.15.0
nuget magick.net-q16-arm64 fix: 14.15.0
nuget magick.net-q16-hdri-anycpu fix: 14.15.0
nuget magick.net-q16-hdri-arm64 fix: 14.15.0
nuget magick.net-q16-hdri-openmp-arm64 fix: 14.15.0
nuget magick.net-q16-hdri-x64 fix: 14.15.0
nuget magick.net-q16-hdri-x86 fix: 14.15.0
nuget magick.net-q16-openmp-arm64 fix: 14.15.0
nuget magick.net-q16-openmp-x64 fix: 14.15.0
nuget magick.net-q16-x64 fix: 14.15.0
nuget magick.net-q16-x86 fix: 14.15.0
nuget magick.net-q8-anycpu fix: 14.15.0
nuget magick.net-q8-arm64 fix: 14.15.0
nuget magick.net-q8-openmp-arm64 fix: 14.15.0
nuget magick.net-q8-openmp-x64 fix: 14.15.0
nuget magick.net-q8-x64 fix: 14.15.0
nuget magick.net-q8-x86 fix: 14.15.0
euvd imagemagick fix: 7.1.2-27

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 18 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in ImageMagick's magick command-line interface, which is used for image processing operations. When the tool parses invalid options, a memory leak occurs because allocated memory is not properly freed after an error, as classified by CWE-401 (Missing Release of Memory after Effective Lifetime). The affected product is identified by the CPE string cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*.

Know when Imagemagick gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 4.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
vuln.today AI 3.3 LOW

Local access, low complexity, no privileges, user must supply malformed options; only temporary availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 3.3 LOW
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat 3.3 LOW

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Passive
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Jul 25, 2026 - 12:03 EUVD
CVE Published
Jul 25, 2026 - 10:45 cve.org
MEDIUM 4.8

DescriptionCVE.org

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.

Threat Intelligence Overview

EPSS Score
0.1%
Top 99% exploitable
Prevalence
High
widely-deployed image processing library across platforms
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

24
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +24
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Imagemagick

View all
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2016-3718 MEDIUM POC
5.5 May 05

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct

CVE-2016-3715 MEDIUM POC
5.5 May 05

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2025-25469 HIGH POC
8.8
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
ADVISORY https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvhv-g4rq-3hmw ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-66011 ADVISORY https://vuldb.com/vuln/383078 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3414/ REF https://www.vulncheck.com/advisories/imagemagick-before-27-memory-leak-via-invalid-cli-options

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy