Is there a patch available for CVE-2026-61866?

Yes, a patch is available for CVE-2026-61866. Update the affected software to the latest version immediately.

ImageMagick CVE-2026-61866

Q: What is the CVSS score of CVE-2026-61866?

CVE-2026-61866 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44615 LOW

Memory Leak (CWE-401)

2026-07-15 VulnCheck

GHSA-848j-9x6v-4m2q

Denial Of Service Imagemagick

2.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.1 LOW

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.9 LOW

Local vector and high complexity reflect that triggering the blob failure requires submitting crafted JNG input to an active process; only low availability impact applies with no C or I.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:31 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

LOW 2.1

DescriptionCVE.org

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion.

AnalysisAI

Memory leak in ImageMagick's JNG encoder before version 7.1.2-26 enables local resource exhaustion when malformed JNG files cause blob open failures without subsequent memory release. The flaw is classified CWE-401 and carries a CVSS 4.0 score of just 2.1, reflecting a local attack vector, high complexity, and availability-only impact - no confidentiality or integrity loss is possible. No public exploit code and no active exploitation (CISA KEV) have been identified, making this a low-priority finding relevant primarily to services that batch-process untrusted image files.

Technical ContextAI

ImageMagick is a widely used open-source image manipulation library and CLI suite. Its JNG (JPEG Network Graphics) encoder relies on an internal blob abstraction layer for file and stream I/O. CWE-401 (Missing Release of Memory after Effective Lifetime) describes the root cause: on the error path triggered when a blob cannot be opened, the encoder fails to free previously allocated memory, causing a gradual heap leak proportional to the number of failed encode operations. The CPE string cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* covers all ImageMagick versions as the affected set, bounded by the fix in 7.1.2-26. JNG itself is a container format combining JPEG and PNG streams, and its encoder path is distinct from the more commonly exercised JPEG/PNG encode paths, limiting the exposed surface.

RemediationAI

Upgrade to ImageMagick 7.1.2-26 or later, which resolves the missing memory release on the JNG encoder's blob-open failure path, per the upstream advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-99w9-hv66-rfv7. For environments where immediate upgrade is not feasible, JNG format processing can be disabled via ImageMagick's policy.xml by adding a deny policy for the JNG delegate - this prevents parsing of JNG files entirely without affecting JPEG or PNG handling, though it breaks any workflow explicitly requiring JNG output. Additionally, restricting submission of untrusted image content to ImageMagick-based services reduces exposure; monitoring long-running conversion processes for abnormal heap growth can provide early warning of active leakage.