CVE-2026-61861
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In ImageMagick before version 7.1.2-26, there is a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures, causing a dangling pointer to reference freed memory, potentially leading to denial of service or code execution.
Risk Assessment
The risk for the organization includes potential denial of service or remote code execution by an attacker who can exploit this vulnerability to take control of the system or disrupt its operations.
Recommendation
It is recommended to immediately upgrade ImageMagick to version 7.1.2-26 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.