ImageMagick CVE-2026-61871

The target system must process attacker-supplied ICON format files using a vulnerable version of ImageMagick (before 7.1.2-26 or before 6.9.13-51). Exploitation requires triggering a memory allocation failure during ICON decoding, which depends on the system being under sufficient memory pressure - this is the basis for the AC:H and AT:P CVSS ratings and makes reliable exploitation non-trivial. No authentication is required (PR:N per CVSS), meaning any system exposing ImageMagick-based image processing to unauthenticated input is in scope. There is no confidentiality or integrity impact; exploitation is limited solely to availability. Exploitation is bounded by the need to induce allocation failure and is not automatable at scale against arbitrary targets.

The CVSS 4.0 score of 6.3 with vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N appropriately characterizes this as a moderate, non-trivial issue. Availability impact is rated Low (VA:L), with no confidentiality or integrity exposure whatsoever. The AC:H and AT:P metrics are critical context: reliably triggering a malloc failure in a controlled way is non-trivial and depends on the memory state of the target system, making this difficult to weaponize reliably at scale. There is no CISA KEV entry, no publicly available exploit code, and no EPSS data provided. The real-world priority is low for most environments: services with strict resource limits or those processing high volumes of untrusted images represent the highest-risk deployments. This is a maintenance-class patch rather than an emergency response item, unless the environment has specific denial-of-service sensitivity requirements.

An attacker submits a maliciously crafted ICON file to a web application or API endpoint that passes user-supplied images through ImageMagick for processing (e.g., thumbnail generation, format conversion). The crafted file is designed to provoke a memory allocation failure within the ICON decoder. With no public exploit confirmed, this most likely requires iterative tuning by the attacker; however, repeated successful submissions would gradually exhaust available memory in the ImageMagick worker process, eventually causing a denial of service.