CVE-2026-61464: ImageMagick Heap Overflow DoS Vulnerability

CVE-2026-61464 Overview

CVE-2026-61464 is a heap-based buffer over-write vulnerability in ImageMagick versions before 7.1.2-26 and 6.9.13-51. The flaw occurs when running an X11 import operation against a window with a crafted title. Processing the malicious window title corrupts heap memory and can lead to denial of service. The issue is classified as CWE-122: Heap-based Buffer Overflow. Exploitation requires local access, high privileges, and user interaction, which limits the practical attack surface. The EPSS score is 0.092% with a percentile of 0.639.

Critical Impact
Heap memory corruption during X11 image capture can crash the ImageMagick process and cause denial of service on the affected host.

Affected Products

ImageMagick versions before 7.1.2-26
ImageMagick 6.x versions before 6.9.13-51
Systems running the import utility against X11 windows

Discovery Timeline

2026-07-15 - CVE-2026-61464 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61464

Vulnerability Analysis

The vulnerability resides in ImageMagick's X11 import code path. When the import utility captures a window, it reads the target window's title through X11 property queries. A crafted window title exceeds an expected size boundary and triggers a heap write beyond the allocated buffer. The out-of-bounds write corrupts adjacent heap metadata or objects, producing an abort or process crash. Because the corruption occurs in a heap region controlled by attacker-influenced input, memory integrity is broken during the capture routine.

Root Cause

The root cause is missing bounds enforcement when copying an X11 window title into a fixed-size or under-allocated heap buffer. ImageMagick trusts the size of the title data returned from the X server and writes it into a destination buffer without validating length against capacity. This pattern maps directly to CWE-122: Heap-based Buffer Overflow.

Attack Vector

Exploitation requires local access to a session running ImageMagick's X11 import command against an attacker-controlled window. An adversary sets a malformed title on a window they own, then relies on a privileged user or automated process invoking import on that window. Successful exploitation yields heap corruption and denial of service rather than code execution based on the current advisory description. Refer to the GitHub Security Advisory GHSA-76q6-2p6h-xjqr and the VulnCheck Security Advisory for further technical detail.

Detection Methods for CVE-2026-61464

Indicators of Compromise

Unexpected crashes or SIGABRT signals from the import binary shipped with ImageMagick.
Core dumps referencing heap corruption inside ImageMagick X11 routines.
X11 windows registered with unusually long or malformed WM_NAME or _NET_WM_NAME properties.

Detection Strategies

Inventory hosts and container images running ImageMagick and compare installed versions against 7.1.2-26 and 6.9.13-51.
Alert on invocations of import from automated pipelines or service accounts, especially against user-owned windows.
Correlate ImageMagick process terminations with recent X11 property changes on the same display.

Monitoring Recommendations

Enable audit logging for execution of import, convert, and related ImageMagick binaries on multi-user hosts.
Monitor for repeated abnormal exits of ImageMagick processes that indicate attempted heap corruption.
Track package inventory changes to ensure patched ImageMagick builds remain deployed.

How to Mitigate CVE-2026-61464

Immediate Actions Required

Upgrade ImageMagick to 7.1.2-26 or later, or to 6.9.13-51 or later on the 6.x branch.
Restrict use of the X11 import utility on shared or multi-tenant systems until patches are applied.
Remove or disable ImageMagick from container images and hosts where it is not required.

Patch Information

Fixed builds are available in ImageMagick 7.1.2-26 and 6.9.13-51. Distribution maintainers typically backport the fix; verify vendor package versions against the advisories linked in the GitHub Security Advisory and the VulnCheck Security Advisory.

Workarounds

Avoid running import against untrusted or attacker-controlled windows on shared X11 sessions.
Constrain ImageMagick invocation to non-privileged accounts using process isolation or containerization.
Enforce policy.xml restrictions to disable unused ImageMagick coders and reduce attack surface pending patch deployment.

bash

# Configuration example: verify installed ImageMagick version
magick -version | head -n 1

# Debian/Ubuntu: upgrade to a patched build
sudo apt-get update && sudo apt-get install --only-upgrade imagemagick

# Red Hat/Fedora: upgrade via dnf
sudo dnf upgrade ImageMagick