CVE-2026-66011

Executive Summary

CVE-2026-66011 is a memory leak vulnerability in ImageMagick's magick command‑line interface, affecting versions prior to 7.1.2-27. By repeatedly supplying malformed or invalid command-line options, an attacker can cause the process to allocate memory without properly freeing it, leading to resource exhaustion (denial of service). This vulnerability does not require special privileges; any user who can invoke the magick binary with crafted arguments can trigger it. Although the EPSS score is currently 0.0%, the low complexity and lack of authentication make it a viable tool for local denial‑of‑service attacks. No public exploit code has been released, but the attack vector is straightforward to reproduce.

CVSS Breakdown & Threat Level

No CVSS vector has been officially assigned. Based on the description, an estimated assessment would rank this as Medium severity:

• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – attacker must run the command
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

Estimated CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Estimated Score: 5.5 (Medium)

Deep Dive & Mechanics

The magick CLI parses command-line options through a series of internal handlers. When an invalid or malformed option (e.g., an unknown flag, or a legitimate option with a nonsensical value) is encountered, the parsing routine fails to clean up previously allocated memory buffers. Over successive invocations—or within a single script that calls the program many times—memory consumption grows linearly until the system runs out of available RAM, causing a denial of service.

The vulnerability lies in the option‑handling code path that processes arguments like -define, -channel, or custom -transform parameters. Without proper validation and deallocation on error, each invalid argument leaves a small heap allocation stranded. An attacker can automate the exploitation by running a loop:

while true; do
    magick input.png -invalidoption garbage output.png 2>/dev/null
done

This rapidly exhausts system memory. In multi‑user environments, a low‑privileged user can degrade service for all other processes.

Vulnerable vs. Patched Code

The fix in ImageMagick 7.1.2-27 adds proper cleanup routines in the option‑parsing functions. A simplified comparison:

Vulnerable (pseudo‑code):

OptionInfo *option = ParseOption(argv[i]);
if (option == NULL) {
    // error path – memory allocated in previous steps not freed
    return(MagickFalse);
}

Patched (pseudo‑code):

OptionInfo *option = ParseOption(argv[i]);
if (option == NULL) {
    // Free any partial allocations
    ReleaseMemory(&temp_buffer);
    return(MagickFalse);
}

The exact patch touches several files in coders/, magick/, and wand/. Users should consult the official changelog for the 7.1.2-27 release.

Exploitation & Lab Setup

Red Team (Simulated Attack)

1. Environment: Local Linux or Windows system with ImageMagick ≤7.1.2-26 installed.
2. Craft payload: Create a script that repeatedly invokes magick with a known invalid option:

   #!/bin/bash
   while true; do
       magick /dev/null -invalid_option_ZZZ output.tmp
       if [ $? -ne 0 ]; then
           :  # ignore errors
       fi
   done
   

3. Execute: Run the script as an unprivileged user. Monitor system memory with free -m or Task Manager.
4. Expected result: System memory will gradually fill, eventually causing the OS to kill processes or become unresponsive.

Blue Team (Defense & Detection)

• Limit resource usage: Use ulimit -v (Linux) or Job Objects (Windows) to cap memory available to the magick process.
• Rate‑limiting: Restrict the number of magick invocations per user via cron or process accounting.
• Audit: Enable command‑line auditing (e.g., auditd on Linux, Event Logging on Windows) to detect patterns of repeated magick calls with unusual arguments.
• System hardening: Remove the magick binary from unprivileged users’ PATH if it is not required.

Indicators of Compromise (IOCs)

• Process activity: Repeated spawning of magick or convert processes within a short time window.
• Memory usage: Continuous growth of resident memory for magick processes beyond typical boundaries (>512 MB per instance).
• Command‑line anomalies: Presence of long strings of invalid options in process creation logs (e.g., -invalidoption, --bogus).
• System impact: High swap usage, OOM killer messages in system logs, or slowed response times.

Detection Engineering

YARA Rule (Target process command line)

rule IM_InvalidOption_MemoryLeak {
    meta:
        description = "Detects malformed command-line arguments used to trigger ImageMagick memory leak"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-66011"

    strings:
        $inval = /-[a-z]+[A-Z]{2,}/   // pattern like -invalidoption with uppercase suffix
        $magick = "magick" nocase

    condition:
        $magick and #inval > 3   // at least 3 suspicious option patterns
}

Sigma Rule (Process Creation – Linux)

title: ImageMagick Memory Leak Exploitation via Process Creation
id: 4b2e1f8a-9c3d-4e5f-8a7b-0c1d2e3f4a5b
status: production
description: Detects repeated execution of magick with invalid options, indicative of CVE-2026-66011 exploitation.
author: Valters IT
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66011
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0|startswith: 'magick'
  condition: selection
  timeframe: 1m
  # Add additional filtering for invalid arguments (e.g., a1|contains: '-invalid')
  # This rule should be tuned to count occurrences per user.
falsepositives:
  - Legitimate use of unusual options by administrators.
level: high
tags:
  - attack.t1499
  - cve.2026.66011

Suricata Rule (Network – detection of exploited web application passing arguments)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-66011 ImageMagick memory leak via web upload"; content:"magick"; http_client_body; content:"-invalidoption"; http_client_body; classtype:attempted-dos; sid:202666011; rev:1;)

Note: This Suricata rule is a placeholder for scenarios where a web application passes user-controlled arguments to magick (e.g., via a file conversion endpoint). Adjust as needed.

Remediation & Mitigation

• Patch: Upgrade to ImageMagick version 7.1.2-27 or later.
  • Official download: https://imagemagick.org/script/download.php
  • Source patch: Check the ImageMagick Git repository for the 7.1.2-27 tag.
• Mitigation if patching is delayed:
  • Remove the magick binary from user PATH or restrict execution via sudo or group policies.
  • Use ulimit (Linux) or Process Explorer (Windows) to cap process memory.
  • Monitor for anomalous repetition of the magick command and alert on thresholds.
  • Deploy the provided Sigma/Hunt rules in your SIEM.
• Long‑term:
  • Validate all command-line arguments before passing them to any ImageMagick process.
  • Implement resource quotas for all user‑spawned processes.

Report generated by Valters IT