VDB

CVE-2026-61871

CVE-2026-61871 PUBLISHED CVSS 6.3 MEDIUM

ImageMagick before 7.1.2-26 Memory Leak in ICON decoder

Reported by vulncheck · Published July 15, 2026

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
ImageMagick-c++Amazon Linux1:6.9.13.54-1.amzn2023
ImageMagickImageMagick7.1.2-26, 6.9.13-51

Risk scores

CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected products

VendorProductVersions
ImageMagickImageMagick7.0.0, 7.1.2-26
ImageMagickImageMagick0, 6.9.13-51
ImageMagickImageMagick6.9.13-51, 0, 7.1.2-26
amazon:2023ImageMagick-c++0
imagemagickimagemagick0, 7.0.0
amazon:2023ImageMagick-doc0
amazon:2023ImageMagick-c++-devel0
amazon:2023ImageMagick-libs0
amazon:2023ImageMagick0
amazon:2023ImageMagick-devel0
amazon:2023ImageMagick-perl0

Timeline

  • Jul 15, 2026 CVE Published
  • Jul 16, 2026 Security Advisory (8 in total, the first dated here)
  • Jul 30, 2026 CVE Updated
  • Aug 7, 2026 EPSS Score (25 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-61871
vulnetix vdb fixes CVE-2026-61871

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-61871/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›