Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-25T10:45:55 Imagemagick: ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CWE-772

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.

A flaw was found in ImageMagick. This memory leak vulnerability occurs when invalid options are provided to the magick command-line interface (CLI). An attacker can exploit this by repeatedly supplying malformed command-line arguments, leading to memory exhaustion and a denial of service (DoS) on the affected system.

This vulnerability has a Low impact as it requires local system access and user interaction to exploit. An attacker must repeatedly supply malformed command-line arguments to the `magick` utility, leading to a memory leak and potential resource exhaustion. To mitigate this issue, strictly sanitize inputs to prevent invalid CLI options from being passed to ImageMagick. Enforce process memory limits (via cgroups or ulimit) on ImageMagick executions to prevent potential memory exhaustion. Red Hat Enterprise Linux 6 Out of support scope ImageMagick Red Hat Enterprise Linux 7 Out of support scope ImageMagick https://www.cve.org/CVERecord?id=CVE-2026-66011 https://nvd.nist.gov/vuln/detail/CVE-2026-66011 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvhv-g4rq-3hmw https://www.vulncheck.com/advisories/imagemagick-before-27-memory-leak-via-invalid-cli-options