CVE-2026-53461: ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop

Synopsis

An out-of-bounds heap write in ImageMagick's ICON decoder allows a remote, unauthenticated attacker to crash the affected process. The bug is reachable over the network with no authentication required and no victim interaction needed, making it trivially exploitable against any service that accepts and processes ICON image files. Successful exploitation causes a denial of service by crashing the ImageMagick process. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable service over the network; any internet-exposed or internally networked ImageMagick processing endpoint is in scope.

• AuthenticationNot required

  No credentials or account of any kind are needed to trigger the vulnerable ICON decoding path.

• Victim interactionNot required

  No user action is required; submitting a malformed ICON file to the service is sufficient to trigger the crash.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or specific memory layout are required to trigger the out-of-bounds write.

Blast Radius

• Crashes the ImageMagick worker process, taking down any service or pipeline stage that depends on it for image processing.
• Repeated submissions of a malformed ICON file can sustain a denial-of-service condition, blocking all image processing for affected workloads.
• No confidentiality or integrity impact is indicated by the CVSS vector; data exposure and data modification are not demonstrated attack outcomes for this vulnerability.