CVE-2025-53019

What it actually does

The flaw triggers a memory leak in the magick stream command when a filename template contains multiple consecutive %d format specifiers, causing repeated allocations without corresponding frees.

Why it matters to the business

Sustained use of affected ImageMagick installations can gradually exhaust available memory, leading to degraded performance, service instability, or forced restarts on systems that process images via command-line tools or dependent applications.

How an attack unfolds

An attacker invokes the magick stream command with a crafted output filename containing multiple consecutive %d specifiers; each execution allocates memory that is never released, enabling gradual resource exhaustion when the command is run repeatedly through scripts or automated workflows.

How to fix it

Upgrade to ImageMagick 7.1.2-0 or 6.9.13-26. For source builds, apply commit 3fcd081c0278427fc0e8ac40ef75c0a1537792f7 to imagemagick or commit 363f86d818f807e49269287be9c326f658379685 to imagemagick6. Where immediate patching is not possible, restrict use of the stream subcommand and sanitize filename templates in calling scripts.

How to confirm the fix worked

Confirm the installed version meets or exceeds 7.1.2-0 or 6.9.13-26, then execute the stream command with a test template containing multiple consecutive %d specifiers while monitoring process memory to verify leaks no longer occur.

Typical attack path

1. Locate systems or containers running vulnerable ImageMagick versions
2. Identify or create workflows that invoke the magick stream subcommand
3. Supply a filename template containing multiple consecutive %d specifiers
4. Execute the command repeatedly to trigger cumulative memory leaks

How to detect it

Review command-line audit logs and process execution history for repeated invocations of the magick stream subcommand; correlate with rising memory usage in ImageMagick processes and inspect any automated image-processing workflows.

What your security team should do

• Apply the listed fixed versions or commits immediately on all ImageMagick instances
• Inventory and replace any custom scripts or pipelines that invoke magick stream
• Implement memory usage monitoring and alerting for ImageMagick processes
• Review downstream packages that bundle ImageMagick for coordinated updates