CVE-2026-66011

What it actually does

ImageMagick before 7.1.2-27 leaks memory in the magick command-line interface when it is invoked with invalid or malformed options. Repeated invocations can steadily consume system memory until the host or container experiences memory pressure, process termination, degraded performance, or denial of service. The flaw does not provide code execution, data theft, or direct privilege escalation; its impact is limited to availability.

Why it matters to the business

Systems or services that call ImageMagick for image processing may become slow, unstable, or unavailable if an attacker can repeatedly trigger malformed command-line invocations. The risk is highest for web applications, job queues, upload pipelines, media processing workers, CI systems, or automation that accepts user-controlled image-processing parameters. This is not currently listed in CISA KEV, has very low EPSS, and has no known mature public exploitation, so urgency is moderate to low unless ImageMagick is exposed through high-volume or untrusted processing paths.

How an attack unfolds

An attacker first needs a way to cause the ImageMagick magick CLI to run with attacker-influenced or malformed options. This could be direct local access, a script that passes user input to ImageMagick, or an application feature that builds ImageMagick command lines from request parameters. The attacker repeatedly submits invalid options that trigger the memory leak. Each failed invocation consumes memory that is not properly released. Over time, especially in loops, automated requests, job queues, or constrained containers, memory pressure increases until ImageMagick workers, related application processes, or the operating system begin killing processes or refusing work. The result is a denial-of-service condition rather than compromise of confidentiality or integrity.

How to fix it

Upgrade ImageMagick to version 7.1.2-27 or later wherever the magick CLI is installed or bundled. If vendor packages backport the fix under a different version string, install the vendor's security update and verify the package changelog references the memory leak fix. Where immediate upgrade is not possible, reduce exposure by preventing untrusted users from controlling ImageMagick command-line options, allowlisting permitted operations, rejecting arguments that begin with option prefixes unless explicitly needed, running ImageMagick in memory-limited containers or sandboxes, applying job timeouts and rate limits, and isolating image-processing workers from critical application services.

How to confirm the fix worked

Confirm the installed ImageMagick version is 7.1.2-27 or later, or that the operating system/vendor package includes the backported fix. Check versions using commands such as `magick -version` and package-manager queries. Review application code and wrappers to ensure user input is not passed directly into ImageMagick option positions. In staging, run malformed-option regression tests while monitoring resident memory usage to confirm repeated invalid invocations do not produce sustained memory growth. Also verify operational controls such as memory limits, request throttling, worker restarts, and timeout enforcement are active for image-processing workloads.

Typical attack path

1. Identify a system, script, application feature, or processing pipeline that invokes the ImageMagick magick CLI.
2. Determine whether user-controlled input can influence command-line options or arguments passed to magick.
3. Submit malformed or invalid ImageMagick options that trigger the vulnerable error-handling path.
4. Repeat the malformed invocations manually or through automation to accumulate memory consumption.
5. Cause memory exhaustion in the process, container, worker pool, or host, leading to failed image-processing jobs, process kills, degraded service, or outage.

How to detect it

Investigate whether ImageMagick was already abused by reviewing application logs, job queue logs, web request logs, process execution telemetry, container runtime events, and system memory/OOM logs for repeated failed magick invocations with invalid options. Look for bursts of image-processing failures, unusual argument strings beginning with unsupported option names, repeated short-lived magick processes, abnormal memory growth in image-processing workers, and operating system or container out-of-memory kills involving magick. If process command-line logging is available, search for repeated executions of `magick` followed by invalid or unexpected flags, especially originating from the same user, source IP, API token, job producer, or automation account. In containerized environments, correlate application errors with Kubernetes/container events such as OOMKilled and memory limit breaches. Because exploitation requires malformed command invocation and does not create a unique payload artifact, detection should focus on behavioral patterns rather than a single definitive signature.

• magick: unrecognized option
• magick: invalid option
• magick: unable to open image
• magick: no decode delegate for this image format
• Out of memory: Killed process
• Killed process magick
• oom-kill
• OOMKilled
• CommandLine=*magick* -*
• ProcessName=magick

What your security team should do

• Inventory all servers, containers, build images, serverless packages, and applications that include ImageMagick or invoke the magick CLI.
• Prioritize upgrades to ImageMagick 7.1.2-27 or later on internet-facing upload services, media-processing pipelines, and shared worker infrastructure.
• Review application code for unsafe construction of ImageMagick command lines from user-supplied input and replace it with strict allowlists or safe library bindings.
• Apply memory, CPU, execution-time, queue-depth, and rate limits to ImageMagick workers to contain denial-of-service attempts.
• Monitor for repeated ImageMagick option parsing errors, abnormal magick process counts, container OOM kills, and spikes in failed image-processing jobs.
• Add regression tests for malformed ImageMagick options to CI pipelines for applications that wrap or broker image-processing functionality.