CVE-2026-53465: ImageMagick heap buffer overflow in SF3 encoder

Executive brief

ImageMagick, a widely used suite for displaying and converting images, is vulnerable to a memory corruption issue when processing specific multi-frame image files. An attacker could provide a specially crafted image that, when processed by the SF3 encoder, causes the application to crash or behave unpredictably. This could lead to a denial of service, impacting the availability of services that rely on this library for image processing.

Technical details

A heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) exist in the ImageMagick SF3 encoder. The vulnerability is triggered when the encoder attempts to write a specially crafted multi-frame image, leading to a memory overwrite. The attack vector is local, requiring no special privileges or user interaction beyond the processing of the malicious file. Successful exploitation primarily impacts system availability by causing a crash (Denial of Service). The issue has been addressed in Magick.NET version 14.14.0.

Affected products

• ImageMagick Magick.NET < 14.14.0
• ImageMagick ImageMagick Unknown

Timeline

• 2026-06-09: disclosed: Initial disclosure by reporter 007bsd
• 2026-06-09: patched: Magick.NET 14.14.0 released
• 2026-06-26: advisory: GitHub Advisory GHSA-44cp-c3ww-9rv5 published

References

• https://api.github.com/users/007bsd
• https://github.com/007bsd
• https://api.github.com/users/007bsd/gists%7B/gist_id%7D
• https://api.github.com/users/007bsd/repos
• https://avatars.githubusercontent.com/u/22483432?v=4
• https://api.github.com/users/007bsd/events%7B/privacy%7D