Description
ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).
Published: 2026-07-15
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ImageMagick contains a memory leak in the YUV decoder that triggers when opening of the blob fails. Repeatedly opening maliciously crafted YUV images can cause the program to consume increasing memory until the system resources are exhausted, resulting in a denial of service. Based on the description, it is inferred that images from untrusted sources could be used to trigger this behavior. The flaw is a classic memory leak (CWE-401) that can lead to resource exhaustion also classified under CWE-772.

Affected Systems

The flaw affects ImageMagick versions before 7.1.2-26 and 6.9.x before 6.9.13-51 that process YUV images from untrusted sources are vulnerable.

Risk and Exploitability

The rated CVSS is 6.3, positioning it as than 1%, so exploitation is unlikely at this time. The vulnerability is not listed in CISA KEV, indicating no known large-scale exploitation. Based on the description, it is inferred that attackers who control image input to the affected application could repeatedly trigger the memory leak, causing the service to crash or become unresponsive and delivering a denial of service. The impact also involves resource exhaustion, tied to CWE-772.

Generated by OpenCVE AI on July 31, 2026 at 03:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to version 7.1.2-26 or newer, or to 6.9.13-51 or newer.
  • Limit processing of YUV images to trusted sources or validate the image content before decoding to mitigate the memory leak (CWE‑401) and avoid resource exhaustion (CWE‑772).
  • Implement memory usage monitoring or set resource limits for services using ImageMagick to detect and mitigate potential denial of service.

Generated by OpenCVE AI on July 31, 2026 at 03:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4696-1 imagemagick security update
History

Thu, 16 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 15 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Description ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).
Title ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder
First Time appeared Imagemagick
Imagemagick imagemagick
Weaknesses CWE-401
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Vendors & Products Imagemagick
Imagemagick imagemagick
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-15T13:51:10.322Z

Reserved: 2026-07-10T21:54:26.759Z

Link: CVE-2026-61868

cve-icon Vulnrichment

Updated: 2026-07-15T13:51:04.946Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-15T11:25:53Z

Links: CVE-2026-61868 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:00:15Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime

  • CWE-772

    Missing Release of Resource after Effective Lifetime