CVE-2026-61867: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-61867 is a memory leak vulnerability in the TIFF encoder of ImageMagick that occurs when memory allocation fails during TIFF image processing. It affects all ImageMagick versions before 7.1.2-26 and was published on July 15, 2026. The vulnerability was originally disclosed via GitHub Security Advisory GHSA-jfq9-q63x-rc63 on June 26, 2026, authored by maintainer dlemstra. It carries a CVSS v3.1 base score of 2.9 (Low) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, ImageMagick Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): when a memory allocation fails within the TIFF encoder code path, the error-handling logic does not properly free previously allocated memory before returning, resulting in a small memory leak per failed allocation. An attacker with local access can craft or supply malicious TIFF image files designed to repeatedly trigger allocation failures, causing cumulative memory exhaustion over time. Exploitation requires specific attack conditions to be present (AT:P in CVSS v4.0), contributing to the high attack complexity rating. No public proof-of-concept or technical write-up detailing the specific code location has been published (ImageMagick Advisory, GitHub Advisory).

Successful exploitation results solely in a denial-of-service condition through memory exhaustion; there is no impact on confidentiality or data integrity. An unauthenticated local attacker can cause the ImageMagick process — and potentially the host system — to become unresponsive or crash by repeatedly processing specially crafted TIFF images that trigger allocation failures. The scope is limited to the vulnerable system itself, with no lateral movement potential or data exposure risk associated with this vulnerability (GitHub Advisory, ImageMagick Advisory).

The primary remediation is to upgrade ImageMagick to version 7.1.2-26 or later, which contains the fix for the memory leak in the TIFF encoder (ImageMagick Advisory). If immediate patching is not feasible, administrators should restrict local access to ImageMagick processing capabilities and validate or sanitize TIFF image inputs to prevent processing of potentially malicious files (GitHub Advisory). Given the low severity and absence of active exploitation, this vulnerability can be addressed through normal patch management cycles rather than emergency response.