CVE-2026-61857

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

Scoring

Severity

MEDIUM

CVSS base score

6.3

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS probability

0.27%

CWE

CWE-252

Published

2026-07-11

Last modified

2026-07-13

Affected products

• ImageMagick ImageMagick
• ImageMagick ImageMagick
• ImageMagick ImageMagick

Weakness type

• CWE-252

Related vulnerabilities

• CVE-2026-86749 — snipe-it before 8.7.0 Data Loss via Failed Image Write
• CVE-2026-86739 — Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
• CVE-2026-86141 — xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a...
• CVE-2026-19534 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
• CVE-2026-85649 — (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation...
• CVE-2026-14957 — FIPS mode assertion failure via malicious CERT payload
• CVE-2026-78699 — rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
• CVE-2026-79772 — Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Markdown version · Browse all CVEs