CVE-2026-61860: ImageMagick Use-After-Free Vulnerability

CVE-2026-61860 Overview

CVE-2026-61860 is a use-after-free vulnerability [CWE-416] in ImageMagick versions prior to 7.1.2-26 and 6.9.13-51. The flaw occurs when FreeType initialization fails inside ImageMagick's text rendering path. Instead of exiting cleanly, the affected method continues to reference memory that has already been released. Attackers can trigger the condition by supplying crafted image content that forces FreeType initialization to fail during processing. Successful exploitation can crash the ImageMagick process, resulting in denial of service against applications and services that use the library.

Critical Impact
Remote attackers can trigger a use-after-free through crafted image inputs processed by ImageMagick, causing denial of service in web applications, image conversion pipelines, and any service that renders untrusted images.

Affected Products

ImageMagick versions prior to 7.1.2-26
ImageMagick 6.x versions prior to 6.9.13-51
Applications and services embedding vulnerable ImageMagick builds for image processing

Discovery Timeline

2026-07-15 - CVE-2026-61860 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61860

Vulnerability Analysis

The vulnerability resides in ImageMagick's text annotation and font rendering path, which depends on the FreeType library for glyph handling. When FreeType initialization fails, the calling method inside ImageMagick does not return early. Execution continues, and the code subsequently dereferences pointers to structures that were already freed as part of the failure cleanup. This produces classic use-after-free behavior, where memory reuse leads to undefined program state.

The primary observed impact is denial of service through process termination. Because the freed memory is dereferenced during image processing, downstream services that invoke ImageMagick on attacker-supplied input can be crashed on demand. The EPSS score at time of publication is 0.221%, reflecting low observed exploitation activity but consistent risk in server-side image processing environments.

Root Cause

The root cause is missing error-path handling. When FreeType initialization returns a failure status, ImageMagick releases associated resources but continues executing the rendering logic. The subsequent access to freed structures satisfies the definition of a use-after-free under CWE-416. A correct implementation must propagate the initialization failure and exit the method before any further access to the affected memory occurs.

Attack Vector

Exploitation requires the attacker to supply image or font-related input that reaches ImageMagick's text rendering path and forces FreeType initialization to fail. The attack vector is network-reachable in typical deployments, since ImageMagick is frequently invoked by web applications, content management systems, and cloud image pipelines that accept user uploads. No authentication or user interaction is required when the target service processes untrusted images automatically. The vulnerability produces availability impact only. It does not, based on the published advisory, provide confidentiality or integrity impact. See the GitHub Security Advisory GHSA-6jwg-7q3p-5fqm and the VulnCheck ImageMagick Advisory for additional technical detail.

Detection Methods for CVE-2026-61860

Indicators of Compromise

Repeated crashes or segmentation faults in processes invoking magick, convert, or ImageMagick library calls
Core dumps referencing FreeType symbols such as FT_Init_FreeType or ImageMagick annotation functions
Unusual spikes in failed image conversion jobs originating from a small set of source addresses

Detection Strategies

Inventory installed ImageMagick versions across servers and container images, flagging any build older than 7.1.2-26 or 6.9.13-51
Monitor application logs from image-processing services for abnormal termination of worker processes handling uploaded content
Correlate web upload telemetry with backend crash events to identify inputs that reliably reproduce the fault

Monitoring Recommendations

Enable process crash reporting and forward core dump metadata to a centralized log platform for review
Track FreeType and ImageMagick package versions in software bill of materials (SBOM) scans on a scheduled cadence
Alert on repeated image processing failures from the same user, IP, or API key within short time windows

How to Mitigate CVE-2026-61860

Immediate Actions Required

Upgrade ImageMagick to 7.1.2-26 or later on the 7.x branch, or to 6.9.13-51 or later on the 6.x branch
Rebuild and redeploy container images and application bundles that vendor ImageMagick binaries or libraries
Restrict image upload endpoints to authenticated users where the business context allows, reducing exposure

Patch Information

Upstream fixes are tracked in the GitHub Security Advisory GHSA-6jwg-7q3p-5fqm. Administrators should confirm that both the ImageMagick package and any statically linked FreeType dependency are updated to versions containing the fix. Linux distribution maintainers typically backport the patch, so check vendor advisories for distribution-specific package versions.

Workarounds

Disable text annotation and font rendering features in ImageMagick policy (policy.xml) if the workload does not require them
Sandbox ImageMagick execution using seccomp, AppArmor, or dedicated worker containers to contain crashes
Enforce strict input validation on image type, dimensions, and metadata before invoking ImageMagick

bash

# Example policy.xml hardening to reduce attack surface
# /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="module" rights="none" pattern="FREETYPE" />
  <policy domain="coder" rights="none" pattern="TTF" />
  <policy domain="coder" rights="none" pattern="OTF" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="time" value="30" />
</policymap>