Junglewise Threat Intelligence

CVE-2026-61870: ImageMagick memory leak in VIFF encoder

CVE-2026-61870 · Severity: low · CVSS 3.1 · Published 2026-07-11

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), ImageMagick, Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: NuGet, ImageMagick.

Executive brief

ImageMagick, a widely used software suite for editing and converting images, is affected by a memory management flaw in its VIFF image encoder. By providing a specially crafted image file, an attacker could cause the software to leak memory, potentially leading to a system slowdown or crash. This impact is generally limited to a denial-of-service condition on the machine processing the image.

Technical details

A memory leak vulnerability (CWE-401) exists in ImageMagick's VIFF encoder. The flaw occurs when a memory allocation failure is encountered during the encoding process, resulting in the software failing to release previously allocated memory. An attacker can exploit this by providing a specially crafted VIFF image designed to trigger these allocation failures. Successful exploitation leads to gradual memory exhaustion and a local denial-of-service (DoS) condition. The vulnerability is addressed in versions 7.1.2-26 and 6.9.13-51.

Affected products

  • ImageMagick ImageMagick < 7.1.2-26
  • ImageMagick ImageMagick < 6.9.13-51

Timeline

  • 2026-06-26: advisory: GitHub Security Advisory published
  • 2026-07-11: disclosed: CVE published to NVD

References

Related threats