CVE-2026-53460: ImageMagick denial of service in AcquireAlignedMemory

Executive brief

ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability has been identified where the software fails to properly limit memory requests when processing certain images. An attacker could exploit this to crash the application or the server it is running on, leading to a denial of service that disrupts business operations and image processing workflows.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in ImageMagick due to a missing check for maximum memory requests in the AcquireAlignedMemory function. This flaw allows an attacker to bypass security policies and trigger an Out-of-Memory (OOM) condition. The vulnerability is reachable over the network without authentication or user interaction. By providing a specially crafted image or request, an attacker can cause the process to consume excessive system memory, leading to a denial of service. The issue is addressed in Magick.NET version 14.14.0.

Affected products

• ImageMagick Magick.NET-Q16-AnyCPU < 14.14.0
• ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.14.0
• ImageMagick Magick.NET-Q8-AnyCPU < 14.14.0
• ImageMagick ImageMagick < 14.14.0

Timeline

• 2026-06-09: disclosed
• 2026-06-09: patched: Magick.NET 14.14.0 released
• 2026-06-25: advisory

References

• https://api.github.com/users/OwenSanzas
• https://github.com/OwenSanzas
• https://api.github.com/users/OwenSanzas/gists%7B/gist_id%7D
• https://api.github.com/users/OwenSanzas/repos
• https://avatars.githubusercontent.com/u/108382772?v=4
• https://api.github.com/users/OwenSanzas/events%7B/privacy%7D