CVE-2026-66011: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-66011 is a memory leak vulnerability in the ImageMagick magick command-line interface (CLI) that allows local attackers to trigger memory exhaustion by repeatedly supplying malformed command-line arguments. It affects all ImageMagick versions before 7.1.2-27. The vulnerability was originally disclosed via a GitHub Security Advisory (GHSA-cvhv-g4rq-3hmw) on July 12, 2026, and published to the NVD on July 25, 2026. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, GitHub Advisory DB).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): when the magick CLI receives invalid or malformed options, it allocates memory for processing those arguments but fails to properly release it before exiting the error-handling path. An attacker with local access can exploit this by invoking the magick command repeatedly with crafted invalid arguments, causing cumulative memory consumption that is never reclaimed. No authentication is required, but user interaction (running the command) is a precondition. No public proof-of-concept code has been identified at this time (GitHub Advisory, GitHub Advisory DB).

Successful exploitation results in a denial-of-service condition through memory exhaustion on the affected host. There is no impact to confidentiality or data integrity — the vulnerability is limited to availability, specifically degrading or crashing processes that depend on available system memory. In environments where ImageMagick is invoked as part of automated pipelines or shared hosting, repeated exploitation could destabilize the host system for other users or services (GitHub Advisory, GitHub Advisory DB).

1. Identify a vulnerable target: Confirm the target system has ImageMagick installed with a version prior to 7.1.2-27 by running magick --version.
2. Craft malformed arguments: Prepare a set of invalid or unrecognized CLI options (e.g., magick -invalidoption /dev/null) that trigger the error-handling code path where memory is allocated but not freed.
3. Repeatedly invoke the command: Execute the malformed command in a loop (e.g., via a shell script or automated tool) to accumulate unreleased memory allocations over time.
4. Achieve memory exhaustion: Continue until available system memory is consumed, causing the operating system to slow down, kill processes via OOM killer, or become unresponsive — resulting in a denial-of-service condition (GitHub Advisory).

• Process: Repeated short-lived magick process invocations with invalid or nonsensical arguments visible in process listings or audit logs.
• System Resources: Rapid or sustained increase in memory consumption on the host, particularly correlated with magick process activity; OOM killer events in system logs (/var/log/syslog or dmesg) referencing the magick process.
• Logs: Shell history or audit logs (auditd) showing looped or scripted invocations of magick with malformed arguments.
• File System: Presence of shell scripts designed to loop magick CLI calls with invalid options.

Upgrade ImageMagick to version 7.1.2-27 or later, which contains the fix for this memory leak (GitHub Advisory). As interim mitigations, restrict local access to the magick CLI to trusted users only, and implement OS-level resource limits (e.g., ulimit or cgroups) on processes running ImageMagick to cap memory usage and limit the impact of any exploitation attempt. Monitoring for unusual patterns of repeated magick invocations with invalid arguments can also help detect abuse.