CVE-2026-61860
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails. The method does not exit and continues to use already freed memory, which can lead to a denial of service.
Risk Assessment
An attacker can exploit this vulnerability to cause a crash of the ImageMagick process during image processing, resulting in disruption of services relying on this library.
Recommendation
Immediately update ImageMagick to version 7.1.2-26 or later (for the 7 branch) or 6.9.13-51 or later (for the 6 branch).
Original NVD description (English source)
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service.