CVE-2026-61870
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
ImageMagick before version 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
Risk Assessment
The risk is the possibility of a DoS attack by sending a malicious VIFF image, which can exhaust server memory and disrupt service availability.
Recommendation
Immediately update ImageMagick to version 7.1.2-26 or later, which includes a fix for the memory leak in the VIFF encoder.
Original NVD description (English source)
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.