ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
CVE-2026-61857
CVSS base score
3.7 (v3.1)
Severity
LOW
Attack vector
Network
Weakness
CWE-252
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
imagemagick imagemagick
References
- github.com Vendor Advisory
- www.vulncheck.com Broken Link