CVE-2026-61867

ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

Published Jul 15, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Description

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.

Analysis

Technical impact

ImageMagick versions earlier than 7.1.2-26 possess a memory leak in the TIFF encoder that is triggered when memory allocation fails. The resulting persistent allocation of unused memory can exhaust system resources, rendering image processing services unavailable. This weakness falls under CWE-401 and CWE-772, indicating unbounded memory usage and improper resource cleanup.

Affected Systems

The affected product is ImageMagick, a widely used image manipulation library. Any installation running a version prior to 7.1.2-26 is vulnerable. The issue does not appear to be limited to specific operating systems or deployment contexts.

Risk and Exploitability

The CVSS score of 2.1 reflects a low severity for this denial‑of‑service condition. The EPSS score of less than 1% indicates a very low probability that public exploits are actively targeting this flaw. It is not listed in CISA’s KEV catalog, which further suggests limited exploitation activity. Attackers would need to supply specially crafted TIFF images to trigger memory allocation failures, leading to gradual memory exhaustion and service denial.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 7.1.2-26
`7.1.2-26`	unaffected	—

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[0,7.1.2-26)`	affected	semver	—
`7.1.2-26`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ImageMagick to version 7.1.2‑26 or later to eliminate the memory‑leak condition.
Deploy image size or complexity limits so that large TIFFs cannot cause excessive allocation attempts, reducing the window for memory exhaustion.
Configure OS‑level resource limits (e.g., cgroups or ulimit) around the ImageMagick process to constrain memory usage and automatically restart the service if limits are breached.

Generated by OpenCVE AI on July 31, 2026 at 03:49 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.139% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jfq9-q63x-rc63
https://nvd.nist.gov/vuln/detail/CVE-2026-61867
https://www.cve.org/CVERecord?id=CVE-2026-61867
https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-tiff-encoder-2

History

Jul 16, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-61867 https://www.cve.org/CVERecord?id=CVE-2026-61867
Metrics	threat_severity `None`	threat_severity `Low`

Jul 15, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 12:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.
Title		ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-401
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jfq9-q63x-rc63 https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-tiff-encoder-2
Metrics		cvssV3_1 `{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`