CVE-2026-61867
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
ImageMagick before version 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.
Risk Assessment
The risk is that an attacker can remotely exhaust server memory by sending a specially crafted TIFF image, potentially causing denial of service for image processing services.
Recommendation
Immediately update ImageMagick to version 7.1.2-26 or later, which includes a fix for the memory leak.
Original NVD description (English source)
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.