CVE-2026-53464

What it actually does

ImageMagick versions prior to 7.1.2-25 contain a small memory leak in the MagickWand option parser when it is given invalid options. A local user, script, or application path that can invoke ImageMagick with attacker-controlled command-line or wand options can repeatedly trigger the leak, causing gradual memory consumption. The flaw does not provide code execution, privilege escalation, data disclosure, or data modification; the impact is limited to reduced availability from resource exhaustion under repeated abuse.

Why it matters to the business

The practical risk is service instability or degraded image-processing capacity if an attacker or malfunctioning workflow repeatedly submits invalid ImageMagick options. Organizations using ImageMagick in batch processing, upload pipelines, media conversion services, CI jobs, or automation may see memory pressure, failed conversions, worker restarts, or localized denial of service. The CVSS and EPSS values are low, it is not listed in CISA KEV, and there is no known exploit maturity, so remediation should be handled through normal patch management unless ImageMagick is exposed through untrusted user-controlled processing paths.

How an attack unfolds

An attacker first needs a way to cause ImageMagick to parse invalid wand options. In the direct case, this is a local execution path where the attacker can run ImageMagick tooling or a program linked against MagickWand. In an indirect case, a web application, API, queue worker, or automation pipeline may expose image transformation parameters that are translated into ImageMagick options. The attacker supplies malformed or unsupported options repeatedly. Each parse attempt leaks a small amount of memory. A single attempt is unlikely to be operationally significant, but sustained repetition can accumulate memory consumption, leading to worker slowdowns, process termination by the operating system, failed jobs, or temporary denial of service for image-processing functions.

How to fix it

Upgrade ImageMagick to version 7.1.2-25 or later. If ImageMagick is provided by an operating system package manager, apply the vendor security update that backports this fix and verify the package changelog rather than relying only on the upstream version string. Where immediate upgrade is not possible, reduce exposure by preventing untrusted users from supplying raw ImageMagick options, allowlisting supported transformations, rejecting unknown or malformed parameters before invoking ImageMagick, running image processing in isolated workers or containers, and enforcing memory, CPU, process, and timeout limits through ImageMagick policy.xml, cgroups, containers, systemd limits, job queue limits, or equivalent controls.

How to confirm the fix worked

Confirm the installed ImageMagick version is 7.1.2-25 or later, or that the operating system vendor package includes the backported fix. Common checks include running `magick -version`, `convert -version`, package-manager queries such as `rpm -q ImageMagick`, `dpkg -l | grep -i imagemagick`, or container image software inventory scans. Validate application exposure by reviewing whether any user-controlled input is passed into ImageMagick options. After patching, repeat a controlled invalid-option test in a non-production environment and monitor process memory to confirm repeated invalid option parsing no longer causes growth consistent with the leak.

Typical attack path

1. Identify a system or application path that uses ImageMagick or MagickWand to process images or transformation options.
2. Determine whether user-controlled input can influence ImageMagick command-line arguments or wand options.
3. Submit malformed, unsupported, or intentionally invalid options that reach the wand option parser.
4. Repeat the requests or executions at sufficient volume to accumulate leaked memory.
5. Cause ImageMagick workers, batch jobs, containers, or host processes to consume excess memory, fail conversions, restart, or be killed by resource limits.

How to detect it

To assess possible prior exploitation, review application, web, job-worker, container, and system logs for repeated ImageMagick invocations or errors involving invalid or unknown options, especially when correlated with rising memory usage, process restarts, OOM kills, failed image conversions, or high request volume from the same user or source. Relevant log sources include web access logs, API gateway logs, upload/conversion service logs, queue worker logs, container runtime events, systemd journals, kernel logs, EDR process telemetry, and application performance monitoring metrics. Focus on patterns rather than single errors: repeated malformed transformation parameters, bursts of ImageMagick failures, recurring `magick`, `convert`, `identify`, or application worker executions followed by memory growth, and kernel or container messages showing the image-processing process was killed for memory exhaustion. There are no public, CVE-specific payload strings or known threat actor indicators associated with this issue, so detection should be behavior-based.

• unrecognized option
• invalid option
• no such option
• cache resources exhausted
• memory allocation failed
• Killed process
• Out of memory: Killed process
• OOMKilled
• magick: unrecognized option
• convert: unrecognized option
• identify: unrecognized option
• mogrify: unrecognized option

What your security team should do

• Inventory all servers, containers, build images, and application dependencies that include ImageMagick or MagickWand.
• Prioritize patching systems where ImageMagick processes untrusted uploads, API-supplied transformation parameters, queue jobs, or multi-tenant workloads.
• Upgrade to ImageMagick 7.1.2-25 or later, or apply the relevant vendor-backported package update.
• Remove any application behavior that passes arbitrary user-supplied options directly to ImageMagick; use allowlisted transformations instead.
• Apply resource controls for image-processing workers, including memory limits, execution timeouts, queue throttling, and automatic worker recycling.
• Monitor for repeated ImageMagick failures, invalid option errors, abnormal memory growth, OOM kills, and elevated image-processing job failure rates.
• Treat this as normal-priority remediation unless the product is internet-facing and allows untrusted users to influence ImageMagick options.