Is there a patch available for CVE-2026-61864?

Yes, a patch is available for CVE-2026-61864. Update the affected software to the latest version immediately.

ImageMagick CVE-2026-61864

Q: What is the CVSS score of CVE-2026-61864?

CVE-2026-61864 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44613 LOW

Memory Leak (CWE-401)

2026-07-15 VulnCheck

GHSA-24c8-2q6j-8jw4

Information Disclosure Imagemagick

2.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.1 LOW

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.9 LOW

Local vector and high complexity to trigger failure path; no confidentiality or integrity impact, only minor availability loss.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:32 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

LOW 2.1

DescriptionCVE.org

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released.

AnalysisAI

ImageMagick's log colorspace color transformation leaks a small amount of memory when the operation fails, affecting versions prior to 7.1.2-26 and 6.9.13-51. The flaw (CWE-401) resides in an error-handling code path that fails to release allocated memory, meaning repeated invocations that trigger failures could contribute to incremental memory exhaustion. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; the CVSS 4.0 score of 2.1 reflects the highly constrained and low-impact nature of this issue.

Technical ContextAI

ImageMagick is an open-source image processing library and command-line toolset (CPE: cpe:2.3:a:imagemagick:imagemagick) that supports a broad range of color spaces, including the log colorspace used in high-dynamic-range and cinematic image workflows. CWE-401 (Missing Release of Memory after Effective Lifetime) describes a defect where memory is allocated but not freed upon an exceptional exit path. In this case, the failure branch of the log colorspace transformation routine omits a deallocation call, causing a per-failure memory leak of a small fixed size. This class of defect is typically introduced in error-handling code that diverges from the success path before reaching cleanup logic.

RemediationAI

Upgrade to ImageMagick 7.1.2-26 or later for the current stable branch, or to 6.9.13-51 or later for the legacy 6.x branch. These fix versions are confirmed by the vendor advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7c7m-fpjw-gwcq. If immediate patching is not possible, the most targeted compensating control is to disable or restrict processing pipelines that perform log colorspace conversions (via -colorspace Log in CLI usage or equivalent API calls), which eliminates exposure to this specific code path. This trade-off may impact HDR or log-format image workflows. Given the low severity and strictly local, high-complexity trigger conditions, this issue should be patched during routine maintenance cycles rather than emergency response.