CVE-2026-61868

LowCVSS 3.7

Published: 15/07/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

A vulnerability in ImageMagick before versions 7.1.2-26 and 6.9.13-51 causes a memory leak in the YUV decoder when blob opening fails. Repeated triggering can lead to resource exhaustion (denial of service).

Risk Assessment

The risk is a potential DoS attack by sending specially crafted files, which can exhaust memory and crash the service.

Recommendation

Immediately upgrade ImageMagick to version 7.1.2-26 or later (for 7.x branch) and 6.9.13-51 or later (for 6.9.x branch).

Original NVD description (English source)

ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).