ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
CVE-2026-61870
CVSS base score
2.9 (v3.1)
Severity
LOW
Attack vector
Local
Weakness
CWE-401
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
imagemagick imagemagick
References
- github.com Vendor Advisory
- www.vulncheck.com Broken Link