Is there a patch available for EUVD-2026-44612?

Yes, a patch is available for EUVD-2026-44612. Update the affected software to the latest version immediately.

ImageMagick EUVD-2026-44612

Q: What is the CVSS score of EUVD-2026-44612?

EUVD-2026-44612 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-61863 LOW

Memory Leak (CWE-401)

2026-07-15 VulnCheck

GHSA-v799-gfw3-g83c

Information Disclosure Imagemagick

2.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.1 LOW

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.9 LOW

Local vector and high complexity required to trigger temp-file failure; no confidentiality or integrity impact, only minor availability from accumulated memory leak.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:32 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

LOW 2.1

DescriptionCVE.org

ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak.

AnalysisAI

ImageMagick's TIFF encoder leaks a small quantity of memory when a temporary file cannot be created during encoding operations, affecting versions 7.x before 7.1.2-26 and 6.x before 6.9.13-51. The CVSS 4.0 score of 2.1 and vector (AV:L/AC:H/AT:P) place this firmly in minimal-severity territory: exploitation is local, requires high complexity, and depends on a platform-specific precondition. No public exploit has been identified, the flaw is not listed in CISA KEV, and the described impact is limited to a small, incremental availability reduction with no confidentiality or integrity consequences.

Technical ContextAI

ImageMagick is an open-source image processing library and toolset, identified by CPE cpe:2.3:a:imagemagick:imagemagick. The root cause class is CWE-401 (Missing Release of Memory after Effective Lifetime): a code path in the TIFF encoder that handles a temporary-file-creation failure exits without freeing previously allocated memory. This error-path leak is not triggered during normal TIFF encoding - it surfaces only when the underlying OS or filesystem returns an error on temporary file creation (e.g., full disk, restricted /tmp, exhausted file descriptors). The TIFF encoder's reliance on a temporary file as an intermediate buffer is an implementation detail of how ImageMagick stages encoded output before writing it to the destination.

RemediationAI

Upgrade to ImageMagick 7.1.2-26 or later on the 7.x branch, or to 6.9.13-51 or later on the 6.x branch. These fix versions are confirmed by the vendor advisory at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6vxp-gfwf-hcr9. Given the minimal severity and the error-condition-only trigger, a formal workaround is generally unnecessary. For environments where ImageMagick processes untrusted TIFF files at sustained high volume and disk space is constrained, ensuring adequate free space and inode availability in the temporary directory (typically /tmp) will prevent the error path from being reached, effectively eliminating the leak trigger with no functional trade-off. Restricting TIFF input processing entirely is an option only if TIFF support is not operationally required.