Home

Description

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.

PUBLISHED Reserved 2026-07-10 | Published 2026-07-11 | Updated 2026-07-11 | Assigner VulnCheck




LOW: 2.1CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
LOW: 2.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Problem types

Missing Release of Memory after Effective Lifetime

Product status

Default status
unaffected

Any version before 7.1.2-26
affected

7.1.2-26 (semver)
unaffected

Default status
unaffected

Any version before 6.9.13-51
affected

6.9.13-51 (semver)
unaffected

References

github.com/...Magick/security/advisories/GHSA-m596-67p7-69wh (GitHub Security Advisory (GHSA-m596-67p7-69wh)) vendor-advisory

www.vulncheck.com/...-before-26-memory-leak-via-viff-encoder (VulnCheck Advisory: ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder) third-party-advisory

cve.org (CVE-2026-61870)

nvd.nist.gov (CVE-2026-61870)

Download JSON