CVE-2026-61857
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In ImageMagick before version 7.1.2-26, there is a heap use-after-free vulnerability caused by a missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
Risk Assessment
The risk involves the possibility of remotely causing application crashes by sending a crafted image file, which may lead to disruption of image processing services.
Recommendation
It is recommended to immediately upgrade ImageMagick to version 7.1.2-26 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.