CVE-2026-61465 Overview
CVE-2026-61465 is a denial of service vulnerability in ImageMagick versions before 7.1.2-26 and 6.9.13-51. The flaw resides in matrix-backed operations such as -canny, where the software fails to enforce the configured memory allocation limit. An attacker who supplies a crafted image can force ImageMagick to allocate memory beyond the policy-defined ceiling. This exhausts available resources on the host and results in a denial of service condition. The weakness is classified as [CWE-770] (Allocation of Resources Without Limits or Throttling).
Critical Impact
A crafted input image can bypass ImageMagick's memory policy and exhaust host memory, causing denial of service in any application or pipeline that processes untrusted images.
Affected Products
- ImageMagick versions prior to 7.1.2-26
- ImageMagick 6.x versions prior to 6.9.13-51
- Applications and services embedding vulnerable ImageMagick libraries for image processing
Discovery Timeline
- 2026-07-11 - CVE-2026-61465 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-61465
Vulnerability Analysis
ImageMagick supports a resource policy framework that limits how much memory, disk, and processing time image operations can consume. Administrators configure these limits through policy.xml to defend against maliciously crafted inputs. CVE-2026-61465 breaks that contract for matrix-backed operations. Functions such as the -canny edge detector allocate large intermediate matrices without validating the request against the configured memory ceiling. When a specially crafted image is processed, allocation proceeds until system memory is exhausted.
Root Cause
The root cause is a missing resource limit check in the code paths that back matrix-oriented operators. The affected code does not consult the MagickResourceMemory policy before requesting large buffers derived from attacker-controlled image dimensions. This maps to [CWE-770], allocation of resources without limits or throttling. The fix in 7.1.2-26 and 6.9.13-51 introduces the missing verification against the configured allocation policy.
Attack Vector
Exploitation requires a local vector where an attacker submits a crafted image to a workflow that invokes an affected operator such as -canny. Common exposure paths include web application upload handlers, batch conversion services, and thumbnail generators that pipe user-supplied content through ImageMagick. User interaction is required because the target process must execute the affected operation on the file. Successful exploitation degrades availability rather than confidentiality or integrity.
No verified proof-of-concept code is publicly available. See the GitHub Security Advisory and the VulnCheck Advisory for authoritative technical detail.
Detection Methods for CVE-2026-61465
Indicators of Compromise
- Repeated ImageMagick process terminations with out-of-memory errors in system or container logs
- Sudden memory pressure or OOM killer events correlated with image processing workloads
- Uploaded image files whose declared dimensions or metadata are disproportionate to their file size
Detection Strategies
- Inventory hosts and containers running ImageMagick and confirm versions against 7.1.2-26 and 6.9.13-51
- Alert on ImageMagick child processes whose resident memory exceeds the configured policy.xml limits
- Monitor image processing services for elevated crash rates or restarts following user uploads
Monitoring Recommendations
- Forward convert, magick, and mogrify process telemetry to a central log store for anomaly review
- Track memory allocation histograms per image processing worker and alert on outliers
- Capture the filenames and hashes of images that precede memory exhaustion events for triage
How to Mitigate CVE-2026-61465
Immediate Actions Required
- Upgrade ImageMagick to 7.1.2-26 or 6.9.13-51 or later across all hosts, containers, and build images
- Audit policy.xml to confirm memory, map, and area resource limits are set to sane values for your workload
- Restrict the set of operators exposed to untrusted input, disabling -canny and similar matrix operators where not required
Patch Information
The ImageMagick project addressed the missing allocation check in versions 7.1.2-26 and 6.9.13-51. Refer to the GitHub Security Advisory GHSA-rvhp-75f6-9jqh for the fixed commits and package guidance. Downstream distributions may ship backported fixes under their own package versioning.
Workarounds
- Run ImageMagick under strict cgroup or container memory limits so a single process cannot exhaust host resources
- Reject images whose declared dimensions exceed a documented maximum before invoking ImageMagick operators
- Isolate image processing workers in dedicated sandboxes so a crash does not affect other tenants or services
# Example policy.xml hardening for resource limits
# Place inside <policymap> in /etc/ImageMagick-7/policy.xml
<policy domain="resource" name="memory" value="256MiB"/>
<policy domain="resource" name="map" value="512MiB"/>
<policy domain="resource" name="area" value="128MB"/>
<policy domain="resource" name="disk" value="1GiB"/>
<policy domain="resource" name="width" value="16KP"/>
<policy domain="resource" name="height" value="16KP"/>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
