CVE-2026-105400 in ImageMagick
Summary
by MITRE • 10/08/2026
ImageMagick before 7.1.2-31 contains a resource leak vulnerability that allows attackers to leave file pointers open by supplying a crafted magick script. Attackers can process malicious magick scripts to leak file descriptors, potentially exhausting resources and causing denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The identified vulnerability resides within ImageMagick versions prior to 7.1.2-31 and is classified as a resource management error that leads to the exhaustion of system resources through improper handling of file handles. This flaw allows an attacker who can supply or influence the input magick script, which serves as the configuration language for ImageMagick operations, to trigger a condition where file pointers are not properly closed after use. The core technical issue stems from insufficient cleanup procedures within the interpreter logic when processing specific crafted scripts that exploit edge cases in resource allocation and deallocation routines. By repeatedly invoking these malformed instructions, an attacker can cause the application to accumulate open file descriptors without releasing them back to the operating system pool.
From a security perspective, this vulnerability aligns with CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime, which describes scenarios where resources are allocated but never freed, leading to potential denial of service conditions. The operational impact is primarily centered on availability rather than confidentiality or integrity in the immediate sense, as the primary consequence is the depletion of available file descriptors for the process hosting ImageMagick. In environments where ImageMagick runs with elevated privileges or handles a high volume of concurrent requests, such as web servers processing user-uploaded images, this resource leak can rapidly exhaust system limits. Once the maximum number of open files is reached, subsequent operations will fail, resulting in a denial of service for legitimate users and potentially causing instability in dependent services that rely on image processing capabilities.
This attack vector maps to MITRE ATT&CK technique T1496: Resource Hijacking, specifically under the sub-technique of resource exhaustion via file descriptor leaks. The attacker leverages the trusted nature of magick scripts within ImageMagick workflows to execute actions that degrade system performance without necessarily gaining unauthorized access or executing arbitrary code directly through this specific flaw. While some versions may have additional protections against script execution from untrusted sources, the vulnerability persists in configurations where such inputs are permitted or when attackers can manipulate input data that gets interpreted as a magick script. The lack of robust resource tracking and cleanup mechanisms allows for sustained degradation of service quality over time rather than an immediate crash, making it particularly insidious in long-running daemon processes.
Mitigation strategies must prioritize upgrading to ImageMagick version 7.1.2-31 or later, where the underlying file descriptor management logic has been corrected to ensure proper closure upon script completion or error conditions. For environments that cannot immediately upgrade, implementing strict input validation and sanitization of magick scripts is essential to prevent the execution of crafted payloads. Additionally, deploying runtime resource limits such as ulimit settings on Linux systems can restrict the maximum number of open file descriptors per process, thereby containing the impact of any successful exploitation attempt. Monitoring system metrics for abnormal increases in open file counts associated with ImageMagick processes can also serve as an early detection mechanism to identify potential abuse before total service exhaustion occurs.