CVE-2026-61857: ImageMagick Use-After-Free Vulnerability

CVE-2026-61857 Overview

CVE-2026-61857 is a heap use-after-free vulnerability in ImageMagick versions before 7.1.2-26. The flaw exists in the XMP profile parsing logic, where a missing null check [CWE-252] leads to memory being referenced after it has been freed. Attackers can craft a malicious image file containing specially structured XMP metadata to trigger the condition. Successful exploitation causes the ImageMagick process to crash, resulting in denial of service for any application or service that processes untrusted images through the library.

Critical Impact
Attackers can crash ImageMagick-based services by supplying a crafted image with malicious XMP data, disrupting image processing pipelines and dependent applications.

Affected Products

ImageMagick versions prior to 7.1.2-26
Applications and web services embedding vulnerable ImageMagick builds
Image processing pipelines that accept untrusted user-supplied files

Discovery Timeline

2026-07-11 - CVE-2026-61857 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-61857

Vulnerability Analysis

The vulnerability resides in ImageMagick's handling of Extensible Metadata Platform (XMP) profiles embedded within image files. During parsing, the library dereferences a pointer without first verifying that it is non-null, a defect classified as [CWE-252] Unchecked Return Value. When crafted XMP data forces the parser down a code path where an allocation or lookup returns null, the subsequent access reuses memory that has already been released, producing a heap use-after-free condition.

The issue is reachable over the network because ImageMagick is commonly invoked by web applications, content delivery pipelines, and document conversion services that accept uploaded images. Exploitation requires attacker-controlled input to reach the XMP parser and does not require authentication or user interaction on the server side.

Root Cause

The root cause is a missing null check in the XMP profile parsing routine. When the parser encounters malformed or unexpected XMP structures, an internal function returns a null pointer that the caller assumes is valid. The subsequent operation touches freed heap memory, corrupting parser state and terminating the process.

Attack Vector

An attacker delivers a crafted image file to any endpoint that passes the file to ImageMagick. Typical delivery paths include avatar uploads, document previews, thumbnail generation, and automated image conversion. When ImageMagick reads the XMP segment, the use-after-free triggers and the process crashes. Detailed technical analysis is available in the VulnCheck Advisory on ImageMagick and the GitHub Security Advisory GHSA-qh5g-q395-cx4j.

Detection Methods for CVE-2026-61857

Indicators of Compromise

Repeated crashes or segmentation faults in convert, magick, or identify processes on servers that handle uploaded images
Core dumps referencing XMP parsing functions within libMagickCore
Elevated 5xx error rates on upload or thumbnail endpoints correlated with specific client requests
Inbound image uploads containing oversized, malformed, or truncated XMP metadata segments

Detection Strategies

Inspect image uploads with a metadata scanner such as exiftool to flag anomalous or malformed XMP profiles before they reach ImageMagick
Monitor process exit codes and crash logs from image conversion workers and correlate with the originating request
Deploy YARA rules that identify malformed XMP packets embedded in JPEG, PNG, and TIFF containers

Monitoring Recommendations

Log the ImageMagick version reported by magick -version across all hosts and alert when it is below 7.1.2-26
Track image processing service restarts and worker respawn frequency as a signal of exploitation attempts
Forward application and container logs to a centralized platform to correlate crashes with client IPs and uploaded file hashes

How to Mitigate CVE-2026-61857

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-26 or later on all systems that process untrusted images
Rebuild and redeploy container images, serverless functions, and bundled application packages that ship an older ImageMagick
Restrict which image formats and metadata profiles are accepted at the application boundary

Patch Information

The fix is included in ImageMagick 7.1.2-26. Refer to the GitHub Security Advisory GHSA-qh5g-q395-cx4j for the upstream patch and release notes. Linux distributions typically publish backported packages through their standard security update channels.

Workarounds

Strip XMP metadata from uploaded images before invoking ImageMagick, for example by preprocessing with exiftool -XMP:all=
Use ImageMagick policy files in /etc/ImageMagick-7/policy.xml to disable processing of untrusted profile types
Isolate image processing in a sandboxed worker with automatic restart so that a crash does not propagate to the parent service

bash

# Example policy.xml entry to disable XMP profile processing
<policymap>
  <policy domain="module" rights="none" pattern="XMP" />
  <policy domain="coder" rights="none" pattern="XMP" />
</policymap>