Junglewise Threat Intelligence

CVE-2026-61863: ImageMagick memory leak in TIFF encoder

CVE-2026-61863 · Severity: low · CVSS 3.1 · Published 2026-07-15

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), ImageMagick, Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: NuGet, ImageMagick.

Executive brief

ImageMagick, a widely used software suite for displaying and converting images, contains a minor flaw in how it handles TIFF files. Under specific conditions where the system cannot create temporary files, the software fails to release a small amount of memory. While this is unlikely to cause a major outage, repeated occurrences could theoretically lead to a gradual slowdown of the affected system.

Technical details

A memory leak (CWE-401) exists in the TIFF encoder of ImageMagick. The vulnerability is triggered when the application attempts to encode a TIFF image but fails to create a necessary temporary file; in this error path, previously allocated memory is not properly released. The attack complexity is high as it requires a specific local environment state (failure of temporary file creation). An attacker with local access could potentially cause a minor denial-of-service through memory exhaustion over a long period of repeated triggers. The issue is resolved in versions 7.1.2-26 and 6.9.13-51.

Affected products

  • ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51

Timeline

  • 2026-06-26: advisory: GitHub Security Advisory published
  • 2026-07-15: disclosed: NVD publication date

References

Related threats