VulnerabilityAnalyzed

CVE-2026-61870

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails.

LOW 2.1EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-401
Affected: imagemagick/imagemagick
Source: disclosure@vulncheck.com

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69whVendor Advisory
https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-via-viff-encoderBroken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.