Executive brief
ImageMagick is a popular software suite used for editing and converting digital images. A flaw in its command-line tool allows memory to leak when it processes incorrect or malformed instructions. If an attacker can repeatedly force the system to run these invalid commands, it could eventually exhaust the server's memory, leading to a slowdown or a complete service outage.
Technical details
A memory leak vulnerability (CWE-401) exists in the ImageMagick 'magick' command-line interface. The root cause is a failure to properly release allocated memory when the utility encounters invalid or malformed command-line options. An attacker with the ability to execute local commands or influence command-line arguments (potentially through a web application wrapper) can trigger repeated leaks. This can lead to a denial-of-service (DoS) condition via system resource exhaustion. The issue is resolved in version 7.1.2-27.
Affected products
- ImageMagick ImageMagick < 7.1.2-27
Timeline
- 2026-07-12: advisory: GitHub Security Advisory published
- 2026-07-25: disclosed: NVD publication date