CVE-2026-66011CWE-401

CVE-2026-66011

Low · published July 25, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00134 · 2.6th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-07-25T15:17Z
Affected products (1)
ProductVersionsFixed in
imagemagick/imagemagick< 7.1.2-277.1.2-27
References (2)
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvhv-g4rq-3hmw · [email protected]https://www.vulncheck.com/advisories/imagemagick-before-27-memory-leak-via-invalid-cli-options · [email protected]
EPSS history
Timeline
  • 25 JUL 10:45Z
    ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options
    cvelistv5