Description
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.
Published: 2026-07-15
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ImageMagick versions earlier than 7.1.2-26 possess a memory leak in the TIFF encoder that is triggered when memory allocation fails. The resulting persistent allocation of unused memory can exhaust system resources, rendering image processing services unavailable. This weakness falls under CWE-401 and CWE-772, indicating unbounded memory usage and improper resource cleanup.

Affected Systems

The affected product is ImageMagick, a widely used image manipulation library. Any installation running a version prior to 7.1.2-26 is vulnerable. The issue does not appear to be limited to specific operating systems or deployment contexts.

Risk and Exploitability

The CVSS score of 2.1 reflects a low severity for this denial‑of‑service condition. The EPSS score of less than 1% indicates a very low probability that public exploits are actively targeting this flaw. It is not listed in CISA’s KEV catalog, which further suggests limited exploitation activity. Attackers would need to supply specially crafted TIFF images to trigger memory allocation failures, leading to gradual memory exhaustion and service denial.

Generated by OpenCVE AI on July 31, 2026 at 03:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to version 7.1.2‑26 or later to eliminate the memory‑leak condition.
  • Deploy image size or complexity limits so that large TIFFs cannot cause excessive allocation attempts, reducing the window for memory exhaustion.
  • Configure OS‑level resource limits (e.g., cgroups or ulimit) around the ImageMagick process to constrain memory usage and automatically restart the service if limits are breached.

Generated by OpenCVE AI on July 31, 2026 at 03:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 15 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Description ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.
Title ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder
First Time appeared Imagemagick
Imagemagick imagemagick
Weaknesses CWE-401
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Vendors & Products Imagemagick
Imagemagick imagemagick
References
Metrics cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-15T12:21:43.606Z

Reserved: 2026-07-10T21:54:26.759Z

Link: CVE-2026-61867

cve-icon Vulnrichment

Updated: 2026-07-15T12:21:38.571Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-15T11:25:52Z

Links: CVE-2026-61867 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:00:15Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime

  • CWE-772

    Missing Release of Resource after Effective Lifetime