Is there a patch available for CVE-2026-61464?

Yes, a patch is available for CVE-2026-61464. Update the affected software to the latest version immediately.

ImageMagick CVE-2026-61464

Q: What is the CVSS score of CVE-2026-61464?

CVE-2026-61464 has a CVSS 4.0 base score of 1.0 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44652 LOW

Heap-based Buffer Overflow (CWE-122)

2026-07-15 VulnCheck

GHSA-mqfp-wcwx-w65x

Heap Overflow Buffer Overflow Denial Of Service Imagemagick

1.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

1.0 LOW

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

1.8 LOW

Local-only vector, high privilege and complexity, user interaction needed, with only low availability impact and no confidentiality or integrity effect.

3.1 AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:34 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

LOW 1.0

DescriptionCVE.org

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service.

AnalysisAI

Heap-based buffer over-write in ImageMagick's X11 import functionality exposes local systems to heap memory corruption and denial of service when processing a crafted X11 window title. Affected versions span both the 7.x branch (before 7.1.2-26) and the legacy 6.x branch (before 6.9.13-51), covering a large installed base across Linux and Unix environments. No public exploit identified at time of analysis, and the narrow exploitation conditions - requiring local privileged access with X11 in scope - significantly constrain real-world risk despite the CWE-122 heap overflow class.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) describes a write operation that extends beyond the bounds of heap-allocated memory. In this case, the vulnerable code path is triggered during ImageMagick's X11 import operation, a feature allowing image capture from X11 window surfaces. The window title string is insufficiently validated before being written into a heap buffer, enabling an over-write when a crafted (oversized or specially structured) title is supplied. The vulnerability exists in both the 7.x (cpe:2.3:a:imagemagick:imagemagick:*) and 6.x (cpe:2.3:a:imagemagick:imagemagick:*) branches per NVD CPE data. X11 import is a non-default, explicitly invoked feature distinct from ImageMagick's standard image conversion pipelines, which limits the reachable attack surface.

RemediationAI

The primary fix is to upgrade to ImageMagick 7.1.2-26 or later on the 7.x branch, or to ImageMagick 6.9.13-51 or later on the 6.x branch, as specified in the vendor advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-76q6-2p6h-xjqr. Distribution maintainers may ship backported fixes; check your package manager for updated imagemagick packages against those fix versions. As a compensating control where patching is not immediately feasible, disable or restrict access to ImageMagick's X11 import functionality by removing or restricting the 'import' binary and related X11-dependent delegates, noting that this may affect image-capture workflows. Restricting local user privileges to prevent non-administrative execution of X11 import commands also eliminates the exploitation path, given the PR:H requirement.