Memory Leak Vulnerability in ImageMagick Command-Line Interface
CVE-2026-66011

4.8MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
25 July 2026

What is CVE-2026-66011?

ImageMagick versions prior to 7.1.2-27 exhibit a memory leak flaw within the command-line interface, triggered by the provision of invalid options. Attackers can exploit this vulnerability by incessantly supplying malformed command-line arguments, leading to memory exhaustion and potential resource depletion on the affected system. This poses risks of system slowdown and stability issues, necessitating urgent attention to mitigate the impact.

Affected Version(s)

ImageMagick 0 < 7.1.2-27

ImageMagick 7.1.2-27

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/imagemagick-before-2...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

007bsd
.