CVE-2026-66011: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-66011 is a memory leak vulnerability in the ImageMagick magick command-line interface (CLI) that allows local attackers to trigger memory exhaustion by repeatedly supplying malformed command-line arguments. It affects all ImageMagick versions before 7.1.2-27 and was published on July 25, 2026, with the underlying security advisory (GHSA-cvhv-g4rq-3hmw) published by maintainer dlemstra on July 12, 2026. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, GitHub Advisory DB).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): when the magick CLI receives invalid or malformed options, it allocates memory for option processing but fails to release it before exiting the error-handling path (GitHub Advisory). An attacker with local access can exploit this by invoking the magick binary in a loop with crafted invalid arguments, causing cumulative memory growth. The attack requires low complexity, no special privileges (per CVSS v4.0), and passive user interaction (e.g., a script or scheduled job that processes user-supplied arguments), with no network access required (GitHub Advisory DB). The vulnerability was reported by researcher 007bsd (GitHub Advisory).

Successful exploitation results in a denial-of-service (DoS) condition through memory exhaustion on the affected host. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (GitHub Advisory DB). In environments where ImageMagick is invoked as part of automated image-processing pipelines or web services, repeated exploitation could degrade or crash the host system, potentially affecting co-located services (Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory DB). The NVD SSVC assessment confirms exploitation status as "none" and technical impact as "partial." The EPSS score is approximately 0.10% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Confirm the target system runs ImageMagick before version 7.1.2-27 by running magick --version locally.
2. Craft malformed arguments: Prepare a set of invalid CLI options (e.g., unrecognized flags or malformed option values) that trigger the memory allocation path without proper cleanup, such as magick -invalid_option_xyz /dev/null.
3. Loop invocations: Execute the malformed command repeatedly in a tight loop (e.g., via a shell script: while true; do magick -invalid_option_xyz /dev/null; done) to accumulate leaked memory across process invocations or within a long-running process.
4. Monitor memory exhaustion: Observe system memory consumption growing until the host's available memory is depleted, causing the OS to invoke the OOM killer or rendering the system unresponsive, achieving a denial-of-service condition (GitHub Advisory).

• Process: Repeated short-lived magick process invocations with invalid or nonsensical arguments visible in process listings (ps, top, or audit logs).
• System Metrics: Sustained, abnormal growth in system memory consumption correlated with magick process activity; OOM killer events in /var/log/kern.log or dmesg referencing the magick process.
• Logs: Shell history or cron logs showing looped invocations of magick with malformed arguments; application logs showing repeated ImageMagick CLI errors for invalid options.

Upgrade ImageMagick to version 7.1.2-27 or later, which contains the fix for this memory leak (GitHub Advisory). SUSE has released a security update (SUSE-SU-2026:3414-1) addressing this and related ImageMagick issues (SUSE Advisory). As interim mitigations: restrict local access to the magick binary to trusted users only, implement OS-level memory limits (e.g., via ulimit or cgroups) on processes running ImageMagick, and monitor for unusual patterns of repeated CLI invocations with invalid arguments (Red Hat Bugzilla).

The vulnerability received routine coverage from vulnerability aggregators and security feeds shortly after publication on July 25, 2026, with entries appearing on VulnDB, Vulners, CVEFeed, and ENISA's EUVD. A Reddit post in r/pwnhub included it in a daily CVE brief. No notable researcher commentary, vendor statements beyond the patch release, or significant media coverage has been identified, consistent with the vulnerability's low severity rating.