Executive brief
ImageMagick is a widely-used image processing toolkit commonly integrated into web applications and automated image processing pipelines. When invalid command-line options are provided to the magick CLI tool, the application fails to properly release memory, causing memory to accumulate over repeated invocations. An attacker or malfunctioning process repeatedly passing invalid options could exhaust available memory and cause service disruption.
Technical details
This is a memory leak vulnerability (CWE-401) in the ImageMagick CLI tool's option parsing logic. When invalid command-line arguments are supplied to the magick command, the application allocates memory for processing but fails to free it before exiting with an error. The vulnerability requires local access and user interaction (a user or process must invoke the tool with invalid options), and the impact is degraded availability through memory exhaustion. The affected versions are all Magick.NET Q8 and Q16 variants before version 14.15.0, which patch the memory leak in ImageMagick 7.1.2-27 and later.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-x86 < 14.15.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-x86 < 14.15.0
Timeline
- 2026-09-02: disclosed: Published to GitHub Advisory Database
- 2026-07-12: patched: Fix included in ImageMagick 7.1.2-27 and Magick.NET 14.15.0