CVE-2026-66011

A flaw was found in ImageMagick. This memory leak vulnerability occurs when invalid options are provided to the magick command-line interface (CLI). An attacker can exploit this by repeatedly supplying malformed command-line arguments, leading to memory exhaustion and a denial of service (DoS) on the affected system.

This vulnerability has a Low impact as it requires local system access and user interaction to exploit. An attacker must repeatedly supply malformed command-line arguments to the magick utility, leading to a memory leak and potential resource exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, strictly sanitize inputs to prevent invalid CLI options from being passed to ImageMagick. Enforce process memory limits (via cgroups or ulimit) on ImageMagick executions to prevent potential memory exhaustion.