CVE-2026-61872: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-61872 is a memory leak vulnerability in ImageMagick's TIFF encoder triggered when an invalid tiff:tile-geometry parameter is specified. Affected versions include ImageMagick before 7.1.2-26 (7.x series) and before 6.9.13-51 (6.9.x series). The vulnerability was published on July 15, 2026, with the original advisory credited to researcher Bin-infinite and published by dlemstra. It carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): when a malformed or invalid tiff:tile-geometry value is supplied to the TIFF encoder, the code path that handles the error fails to free previously allocated memory before returning. This results in a memory leak on each invocation with a malformed parameter. Exploitation requires local access and user interaction (e.g., a user or process invoking ImageMagick with attacker-controlled input), and attack complexity is rated High due to the specific conditions required (GitHub Advisory, Github Advisory).

Successful exploitation causes a denial-of-service condition limited to availability impact: repeated invocations with malformed tiff:tile-geometry parameters cause the ImageMagick process to consume increasing amounts of memory without releasing it, potentially exhausting system memory and crashing the process or degrading host performance. There is no impact on confidentiality or integrity, and no evidence of lateral movement potential or data exposure risk associated with this vulnerability (GitHub Advisory).

1. Identify a vulnerable instance: Confirm the target system is running ImageMagick version prior to 7.1.2-26 (7.x) or 6.9.13-51 (6.9.x) using convert --version or magick --version.
2. Craft a malformed TIFF conversion command: Prepare an ImageMagick command that specifies an invalid tiff:tile-geometry parameter, for example: convert -define tiff:tile-geometry=INVALID input.tif output.tif.
3. Trigger the memory leak: Execute the command repeatedly or in a loop. Each invocation with the malformed parameter causes allocated memory to not be released.
4. Observe memory exhaustion: Monitor system memory (e.g., via top or free) to observe increasing memory consumption, eventually leading to process crash or system-wide resource exhaustion (GitHub Advisory).

• Process: ImageMagick (convert, magick) processes showing steadily increasing memory usage over time without returning memory to the OS.
• Logs: System logs (e.g., /var/log/syslog, /var/log/messages) recording OOM (out-of-memory) killer events targeting ImageMagick processes.
• Command History: Shell history or audit logs showing repeated invocations of convert or magick with -define tiff:tile-geometry=<invalid_value> arguments.
• System Metrics: Anomalous spikes in memory consumption correlated with TIFF image processing jobs (GitHub Advisory).

Update ImageMagick to version 7.1.2-26 or later for the 7.x series, or to version 6.9.13-51 or later for the 6.9.x series, as these releases contain the fix. As a workaround prior to patching, implement input validation to reject malformed or unexpected tiff:tile-geometry parameter values before they are passed to ImageMagick, and restrict local access to ImageMagick processing to trusted users only (GitHub Advisory, Github Advisory).