CVE-2026-61862
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In ImageMagick before versions 7.1.2-26 and 6.9.13-51, there is an information disclosure vulnerability. When a profile is displayed with the identify command and the profile value is not printable, a single byte past the profile boundary can be read. This behavior occurs when debug output is enabled.
Risk Assessment
The risk involves potential leakage of sensitive data from memory, which could lead to disclosure of confidential organizational information.
Recommendation
It is recommended to immediately update ImageMagick to version 7.1.2-26 or later (for branch 7) and 6.9.13-51 or later (for branch 6).
Original NVD description (English source)
ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the profile boundary). This behavior occurs when debug output is enabled.