CVE-2026-61864

ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace

Published Jul 15, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Description

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released.

Analysis

Technical impact

ImageMagick releases before 7.1.2-26 and 6.9.13-51 contain a memory leak in the log colorspace transformation. When the conversion operation fails, a small amount of memory is not released, which results in improper resource management (CWE‑401) and incomplete deallocation (CWE‑772). This deficiency can cause gradual memory exhaustion if the failure scenario is repeated frequently.

Affected Systems

The vulnerability affects all ImageMagick installations provided by ImageMagick, including all releases prior to 7.1.2-26 in the 7.x series and prior to 6.9.13-51 in the 6.x series. Any system that processes images through these libraries may be impacted, independent of platform.

Risk and Exploitability

The CVSS score of 2.1 indicates a low severity, and the EPSS score of less than 1% suggests a minimal chance of exploitation. This issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could repeatedly submit images that trigger to slowly deplete system memory, potentially degrading availability if a resource limit is breached. No public exploit has been documented as of the latest information.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`7.0.0`	affected	< 7.1.2-26
`7.1.2-26`	unaffected	—

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 6.9.13-51
`6.9.13-51`	unaffected	—

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[0,7.1.2-26)`	affected	semver	—
`7.1.2-26`	unaffected	semver	—
`[0,6.9.13-51)`	affected	semver	—
`6.9.13-51`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,7.1.2-26)`	affected	semver	—
`7.1.2-26`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,6.9.13-51)`	affected	semver	—
`6.9.13-51`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install a patched release of ImageMagick that is at least 7.1.2-26 or 6.9.13-51.
If an upgrade is not possible, run image processing processes under strict memory limits or in a sandboxed environment to contain the leak.
Monitor memory consumption of services using ImageMagick and intervene if abnormal growth is detected.

Generated by OpenCVE AI on July 31, 2026 at 03:50 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4696-1	imagemagick security update
Ubuntu USN	USN-8739-1	ImageMagick vulnerabilities
Ubuntu USN	USN-8739-2	ImageMagick vulnerabilities

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.102% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7c7m-fpjw-gwcq
https://nvd.nist.gov/vuln/detail/CVE-2026-61864
https://www.cve.org/CVERecord?id=CVE-2026-61864
https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-log-colorspace

History

Jul 16, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-61864 https://www.cve.org/CVERecord?id=CVE-2026-61864
Metrics	threat_severity `None`	threat_severity `Low`

Jul 15, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 12:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released.
Title		ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-401
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7c7m-fpjw-gwcq https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-log-colorspace
Metrics		cvssV3_1 `{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`