Description
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.
Published: 2026-07-11
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw exists in the FormatMagickCaption routine of ImageMagick that appears when memory allocation fails. The routine retains a pointer to freed memory, allowing an attacker to trigger a denial of service or potentially execute arbitrary code by providing crafted image data that forces the allocation to fail. This vulnerability is categorized as CWE-416 and CWE-825.

Affected Systems

All installations of ImageMagick before version 7.1.2‑26 are affected, regardless of platform or deployment context.

Risk and Exploitability

The CVSS score of 6.3 marks the vulnerability as moderate, and the EPSS score of less than 1% indicates a very low probability of exploitation in the near term. It is not listed in the CISA KEV catalog. Based on the description, the attacker would need to supply image data that triggers a memory allocation failure during caption processing, after which the dangling pointer could be abused to cause a service crash or, if effective in a specific memory state, to execute code.

Generated by OpenCVE AI on July 31, 2026 at 12:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to version 7.1.2‑26 or later
  • If an upgrade cannot be performed immediately, run ImageMagick in a sandboxed environment with reduced privileges and restrict the use of FormatMagickCaption to trusted input only
  • Monitor system logs for out‑of‑memory errors, segmentation faults, or abnormal termination events that may signal exploitation attempts

Generated by OpenCVE AI on July 31, 2026 at 12:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 12 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 11 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.
Title ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption
First Time appeared Imagemagick
Imagemagick imagemagick
Weaknesses CWE-416
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Vendors & Products Imagemagick
Imagemagick imagemagick
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-13T15:07:54.308Z

Reserved: 2026-07-10T21:53:55.769Z

Link: CVE-2026-61861

cve-icon Vulnrichment

Updated: 2026-07-13T15:07:51.173Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-11T13:01:09Z

Links: CVE-2026-61861 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T12:45:03Z

Weaknesses