{"id":"CVE-2026-61870","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-61870","generatedAt":"2026-10-28T10:39:57.577Z","title":"ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails.","description":"ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.","published":"2026-07-11T14:16:24.000Z","lastModified":"2026-07-13T22:07:31.000Z","status":"Analyzed","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":2.1,"severity":"LOW","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-401"],"affected":["imagemagick/imagemagick"],"epss":{"score":0.00191,"percentile":0.08719,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh","tags":["Vendor Advisory"],"source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-via-viff-encoder","tags":["Broken Link"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-61870","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}