Junglewise Threat Intelligence

CVE-2026-61862: ImageMagick out-of-bounds read in identify command

CVE-2026-61862 · Severity: low · CVSS 3.1 · Published 2026-07-15

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), ImageMagick, Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: NuGet, ImageMagick.

Executive brief

ImageMagick is a widely used software suite for editing and converting digital images. A minor security flaw was discovered where the software might inadvertently reveal a single byte of internal memory when processing certain image files while in debug mode. This could potentially lead to a very limited leak of information, though the practical risk to business operations and data is considered low.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in ImageMagick's 'identify' command due to an off-by-one error (CWE-193) when handling non-printable profile values. When debug output is enabled, the application may read and print a single byte beyond the allocated profile buffer. The attack vector is local and requires high complexity to exploit effectively, as it only leaks a single byte under specific debugging conditions. The issue is resolved in versions 7.1.2-26 and 6.9.13-51.

Affected products

  • ImageMagick ImageMagick < 7.1.2-26
  • ImageMagick ImageMagick < 6.9.13-51

Timeline

  • 2026-06-26: advisory: GitHub Security Advisory published
  • 2026-07-15: disclosed: NVD publication date

References

Related threats