Skip to main content

ImageMagick CVE-2026-61868

| EUVDEUVD-2026-44617 MEDIUM
Memory Leak (CWE-401)
2026-07-15 VulnCheck GHSA-f6rf-qwcr-g39q
Denial Of Service Imagemagick Red Hat Suse
6.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

Network-reachable via image upload but high complexity to reliably trigger blob failure; no confidentiality or integrity impact, only gradual availability degradation.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
2.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
3.7 LOW
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 15, 2026 - 13:03 EUVD
Analysis Generated
Jul 15, 2026 - 12:31 vuln.today
CVE Published
Jul 15, 2026 - 11:25 cve.org
MEDIUM 6.3

DescriptionCVE.org

ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).

AnalysisAI

Memory leak in ImageMagick's YUV decoder (versions before 7.1.2-26 and 6.9.x before 6.9.13-51) enables remote denial of service by repeatedly submitting malformed YUV images that trigger a failed blob open, leaking heap memory on each decode attempt. No confidentiality or integrity impact applies; exposure is limited to availability of image-processing services that accept untrusted input. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

ImageMagick is a widely deployed open-source image manipulation library (CPE: cpe:2.3:a:imagemagick:imagemagick). The vulnerability resides in the YUV color-format decoder, which handles YUV-encoded image blobs. When the blob open operation fails - likely due to a malformed or truncated input - the error-handling code path does not release previously allocated heap memory, producing a CWE-401 (Missing Release of Memory After Effective Lifetime) defect. Each failed decode attempt leaves a small, bounded allocation unreleased; the leak is individually minor but cumulatively significant under repeated calls. This class of flaw is common in image-parsing code where complex error paths are added after initial development and cleanup logic is inadvertently omitted from failure branches.

RemediationAI

The primary fix is to upgrade ImageMagick to version 7.1.2-26 or later for the 7.x branch, or to version 6.9.13-51 or later for the 6.9.x branch, as documented in the vendor advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h7f2-f9cc-h2gv. If immediate patching is not feasible, restrict YUV format handling via ImageMagick's policy.xml by adding a deny policy for the YUV coder (e.g., policy domain='coder' rights='none' pattern='YUV') - note this will block all legitimate YUV image operations. Additionally, enforce per-process memory limits using ulimit, cgroup memory caps, or container resource constraints to prevent full host memory exhaustion even if the leak is triggered repeatedly. Rate-limiting image upload endpoints reduces attacker throughput and limits exploitation impact as a defense-in-depth measure.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed

Share

CVE-2026-61868 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy