CVE-2026-61866
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in ImageMagick before version 7.1.2-26 causes a memory leak in the JNG encoder when a blob cannot be opened. Attackers can trigger resource exhaustion by providing malformed JNG files that fail blob operations.
Risk Assessment
The risk is that an attacker can exhaust system memory, leading to denial of service (DoS) and disruption of applications using ImageMagick.
Recommendation
It is recommended to immediately upgrade ImageMagick to version 7.1.2-26 or later, which includes a fix for the memory leak.
Original NVD description (English source)
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion.