# CVE-2026-53460: ImageMagick denial of service in AcquireAlignedMemory

Source: https://junglewise.ai/threats/cve-2026-53460-imagemagick-denial-of-service-in-acquirealignedmemory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-53460 · Severity: high · CVSS 7.5 · Published 2026-06-10

ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability has been identified where the software fails to properly limit memory requests when processing certain images. An attacker could exploit this to crash the application or the server it is running on, leading to a denial of service that disrupts business operations and image processing workflows.

Technologies: [ImageMagick](https://junglewise.ai/threats/technologies/imagemagick), [Magick.NET-Q16-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-anycpu), [Magick.NET-Q16-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-arm64), [Magick.NET-Q16-HDRI-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu), [Magick.NET-Q16-HDRI-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-arm64), [Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-openmp-arm64), [Magick.NET-Q16-HDRI-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x64), [Magick.NET-Q16-HDRI-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86), [Magick.NET-Q16-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-arm64), [Magick.NET-Q16-OpenMP-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-x64), [Magick.NET-Q16-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-x64), [Magick.NET-Q16-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-x86), [Magick.NET-Q8-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-anycpu), [Magick.NET-Q8-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-arm64), [Magick.NET-Q8-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-openmp-arm64), [Magick.NET-Q8-OpenMP-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-openmp-x64), [Magick.NET-Q8-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-x64), [Magick.NET-Q8-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-x86). Vendors: [ImageMagick](https://junglewise.ai/threats/vendors/imagemagick), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-53460 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53460 being exploited in the wild.

**How severe is CVE-2026-53460?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** ImageMagick < 14.14.0; Magick.NET-Q16-AnyCPU (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; Magick.NET-Q16-arm64 (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; Magick.NET-Q16-HDRI-AnyCPU (NuGet) < 14.14.0, ECOSYSTEM:introduced=0,fixed=14.14.0; and 14 more.

**Is there a fix for CVE-2026-53460?** Yes. Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q16-x86 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-x64 (NuGet): upgrade to 14.14.0 or later; Magick.NET-Q8-x86 (NuGet): upgrade to 14.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53460 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53460?** Check whether you run ImageMagick, Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Magick.NET-Q16-AnyCPU (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-AnyCPU --version 14.14.0
  ```

- Magick.NET-Q16-arm64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-arm64 --version 14.14.0
  ```

- Magick.NET-Q16-HDRI-AnyCPU (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.14.0
  ```

- Magick.NET-Q16-HDRI-arm64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.14.0
  ```

- Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.14.0
  ```

- Magick.NET-Q16-HDRI-x64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.14.0
  ```

- Magick.NET-Q16-HDRI-x86 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.14.0
  ```

- Magick.NET-Q16-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.14.0
  ```

- Magick.NET-Q16-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.14.0
  ```

- Magick.NET-Q16-x64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-x64 --version 14.14.0
  ```

- Magick.NET-Q16-x86 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q16-x86 --version 14.14.0
  ```

- Magick.NET-Q8-AnyCPU (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q8-AnyCPU --version 14.14.0
  ```

- Magick.NET-Q8-arm64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q8-arm64 --version 14.14.0
  ```

- Magick.NET-Q8-OpenMP-arm64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.14.0
  ```

- Magick.NET-Q8-OpenMP-x64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.14.0
  ```

- Magick.NET-Q8-x64 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q8-x64 --version 14.14.0
  ```

- Magick.NET-Q8-x86 (NuGet): upgrade to 14.14.0 or later

  ```sh
  dotnet add package Magick.NET-Q8-x86 --version 14.14.0
  ```


## Technical details

A resource exhaustion vulnerability (CWE-770) exists in ImageMagick due to a missing check for maximum memory requests in the AcquireAlignedMemory function. This flaw allows an attacker to bypass security policies and trigger an Out-of-Memory (OOM) condition. The vulnerability is reachable over the network without authentication or user interaction. By providing a specially crafted image or request, an attacker can cause the process to consume excessive system memory, leading to a denial of service. The issue is addressed in Magick.NET version 14.14.0.

## Affected products

- ImageMagick Magick.NET-Q16-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.14.0
- ImageMagick ImageMagick < 14.14.0

## Identifiers

- CVE-2026-53460
- GHSA-q62c-h75r-2xhc

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: patched: Magick.NET 14.14.0 released
- 2026-06-25: advisory

## References

- [https://api.github.com/users/OwenSanzas](https://api.github.com/users/OwenSanzas)
- [https://github.com/OwenSanzas](https://github.com/OwenSanzas)
- [https://api.github.com/users/OwenSanzas/gists%7B/gist_id%7D](https://api.github.com/users/OwenSanzas/gists%7B/gist_id%7D)
- [https://api.github.com/users/OwenSanzas/repos](https://api.github.com/users/OwenSanzas/repos)
- [https://avatars.githubusercontent.com/u/108382772?v=4](https://avatars.githubusercontent.com/u/108382772?v=4)
- [https://api.github.com/users/OwenSanzas/events%7B/privacy%7D](https://api.github.com/users/OwenSanzas/events%7B/privacy%7D)

## Related threats

- [ImageMagick infinite loop in SVG decoder](https://junglewise.ai/threats/cve-2026-123273-imagemagick-before-7-1-2-35-and-6-9-13-60-contains-an-infinite)
- [ImageMagick memory leak in XMP profile handling](https://junglewise.ai/threats/cve-2026-116155-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in XML parsing depth limit](https://junglewise.ai/threats/cve-2026-116154-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)
- [ImageMagick memory leak in MAT decoder](https://junglewise.ai/threats/cve-2026-116152-imagemagick-before-7-1-2-33-contains-a-memory-leak-vulnerability)
- [ImageMagick stack buffer overflow in bzip2 decompression](https://junglewise.ai/threats/cve-2026-116149-imagemagick-before-6-9-13-58-and-7-x-before-7-1-2-33-contains-a)