CVE-2026-53463: ImageMagick null pointer dereference in distort operation

Executive brief

ImageMagick, a widely used suite for displaying and converting images, is vulnerable to a crash when processing specific image distortion commands. If an application uses this library to process user-provided images or commands, an attacker could cause the service to stop responding. This primarily impacts the availability of the service rather than the security of customer data.

Technical details

A NULL pointer dereference (CWE-476) exists in ImageMagick's distort operation. The vulnerability is triggered when the library receives malformed or incorrect arguments during image distortion processing. In the context of Magick.NET, this can be exploited via a network vector if an application processes untrusted input, though it requires some level of user interaction or specific triggering conditions (UI:R). The primary impact is a crash of the process (Denial of Service). The issue is resolved in Magick.NET version 14.14.0.

Affected products

• ImageMagick Magick.NET < 14.14.0

Timeline

• 2026-06-09: disclosed: Initial disclosure by reporter 007bsd
• 2026-06-09: patched: Magick.NET version 14.14.0 released
• 2026-06-26: advisory: GitHub Advisory published

References

• https://api.github.com/users/007bsd
• https://github.com/007bsd
• https://api.github.com/users/007bsd/gists%7B/gist_id%7D
• https://api.github.com/users/007bsd/repos
• https://avatars.githubusercontent.com/u/22483432?v=4
• https://api.github.com/users/007bsd/events%7B/privacy%7D