Is CVE-2026-53460 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53460 being exploited in the wild.

How severe is CVE-2026-53460?

High severity, with a CVSS score of 7.5, published 10 June 2026.

Which products and versions are affected?

ImageMagick < 14.14.0; Magick.NET-Q16-AnyCPU (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; Magick.NET-Q16-arm64 (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; and 14 more.

Is there a fix for CVE-2026-53460?

Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53460 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53460?

Check whether you run ImageMagick, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53460: ImageMagick denial of service in AcquireAlignedMemory

Q: Which products and versions are affected?

ImageMagick < 14.14.0; Magick.NET-Q16-AnyCPU (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; Magick.NET-Q16-arm64 (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; and 14 more.

Q: Is there a fix for CVE-2026-53460?

Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53460 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53460?

Check whether you run ImageMagick, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53460 · Severity: high · CVSS 7.5 · Published 2026-06-10

ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability has been identified where the software fails to properly limit memory requests when processing certain images. An attacker could exploit this to crash the application or the server it is running on, leading to a denial of service that disrupts business operations and image processing workflows.

Quick answers

Is CVE-2026-53460 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53460 being exploited in the wild.
How severe is CVE-2026-53460?: High severity, with a CVSS score of 7.5, published 10 June 2026.
Which products and versions are affected?: ImageMagick < 14.14.0; Magick.NET-Q16-AnyCPU (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; Magick.NET-Q16-arm64 (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; and 14 more.
Is there a fix for CVE-2026-53460?: Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53460 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53460?: Check whether you run ImageMagick, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-AnyCPU --version 14.14.0

Magick.NET-Q16-arm64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-arm64 --version 14.14.0

Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.14.0

Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.14.0

Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.14.0

Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.14.0

Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.14.0

Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.14.0

Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.14.0

Magick.NET-Q16-x64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-x64 --version 14.14.0

Magick.NET-Q16-x86 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q16-x86 --version 14.14.0

Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q8-AnyCPU --version 14.14.0

Magick.NET-Q8-arm64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q8-arm64 --version 14.14.0

Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.14.0

Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.14.0

Magick.NET-Q8-x64 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q8-x64 --version 14.14.0

Magick.NET-Q8-x86 (NuGet): upgrade to 14.14.0 or later

dotnet add package Magick.NET-Q8-x86 --version 14.14.0

Technical details

A resource exhaustion vulnerability (CWE-770) exists in ImageMagick due to a missing check for maximum memory requests in the AcquireAlignedMemory function. This flaw allows an attacker to bypass security policies and trigger an Out-of-Memory (OOM) condition. The vulnerability is reachable over the network without authentication or user interaction. By providing a specially crafted image or request, an attacker can cause the process to consume excessive system memory, leading to a denial of service. The issue is addressed in Magick.NET version 14.14.0.

Affected products

ImageMagick Magick.NET-Q16-AnyCPU < 14.14.0
ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.14.0
ImageMagick Magick.NET-Q8-AnyCPU < 14.14.0
ImageMagick ImageMagick < 14.14.0

Identifiers

CVE-2026-53460
GHSA-q62c-h75r-2xhc

Timeline

2026-06-09: disclosed
2026-06-09: patched: Magick.NET 14.14.0 released
2026-06-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.