Description
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
Published: 2026-07-15
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a memory leak in the MIFF encoder that triggers when a memory allocation fails during MIFF image processing. This leak can cause the ImageMagick service or application to consume increasing amounts of RAM until it becomes unresponsive or crashes, thereby denying service to legitimate workloads. The weakness is classified under CWE-401 (Unreleased Resource) and CWE-770 (Memory Allocation for Indeterminate Order),

Affected Systems

The vulnerability affects ImageMagick products before version 7.1.2-26 and before 6.9.13-51. Any deployment using the affected releases and processing MIFF images is at risk.

Risk and Exploitability

The CVSS score is 2.1 and the EPSS score is below 1%, indicating a low overall risk and a very low probability of exploitation at this time. The vulnerability is not listed in CISA KEV. The most likely attack vector is the local or remote execution of a crafted MIFF file that forces ImageMagick to allocate memory and fail, leading to a leak. Because it does not expose sensitive data or privileges, the primary danger is service disruption rather than data compromise.

Generated by OpenCVE AI on July 31, 2026 at 03:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ImageMagick to version 7.1.2-26 or newer, or to 6.9.13-51 or newer.
  • Once upgraded, restart any services that use ImageMagick to clear old memory allocations.
  • If MIFF image processing is not required, disable the MIFF format in the ImageMagick configuration to prevent the leak from being triggered.

Generated by OpenCVE AI on July 31, 2026 at 03:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4696-1 imagemagick security update
History

Thu, 16 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 15 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Description ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
Title ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder
First Time appeared Imagemagick
Imagemagick imagemagick
Weaknesses CWE-401
CPEs cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Vendors & Products Imagemagick
Imagemagick imagemagick
References
Metrics cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-15T18:03:42.319Z

Reserved: 2026-07-10T21:54:26.759Z

Link: CVE-2026-61869

cve-icon Vulnrichment

Updated: 2026-07-15T18:00:54.911Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-15T11:25:54Z

Links: CVE-2026-61869 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:00:15Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime

  • CWE-770

    Allocation of Resources Without Limits or Throttling