CVE-2026-61862: ImageMagick Information Disclosure Flaw

CVE-2026-61862 Overview

CVE-2026-61862 is an information disclosure vulnerability in ImageMagick, an open source image processing suite widely used in web servers, media pipelines, and desktop applications. The flaw affects versions before 7.1.2-26 and 6.9.13-51. When the identify command displays a profile and the profile value is not printable, ImageMagick can read and print a single byte past the profile boundary. The out-of-bounds read only occurs when debug output is enabled. The issue is classified under CWE-125: Out-of-Bounds Read.

Critical Impact
An attacker who can supply a crafted image processed by identify with debug output enabled may cause ImageMagick to leak a single adjacent byte from process memory.

Affected Products

ImageMagick versions prior to 7.1.2-26
ImageMagick 6.x versions prior to 6.9.13-51
Applications and services embedding vulnerable ImageMagick libraries

Discovery Timeline

2026-07-15 - CVE-2026-61862 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61862

Vulnerability Analysis

The vulnerability resides in the profile display logic invoked by the identify command. When ImageMagick prints profile metadata containing non-printable bytes, the debug output path reads one byte beyond the buffer that stores the profile value. This adjacent byte is then written to the debug stream visible to the caller.

Exploitation requires local access, debug output to be enabled, and a crafted profile value that exercises the non-printable branch. The disclosed content is limited to a single byte per invocation, which constrains practical impact but can still leak sensitive adjacent memory such as heap metadata or fragments of other allocations.

Root Cause

The root cause is an off-by-one boundary condition in the profile printing routine. The code path that handles non-printable profile values does not correctly enforce the profile length before dereferencing the trailing byte. This results in a one-byte out-of-bounds read [CWE-125] each time the debug branch executes on a qualifying profile.

Attack Vector

The attack vector is local. An attacker must be able to submit an image containing a crafted profile to a system that runs identify with debug output enabled. Server-side image processing pipelines that log debug output to accessible destinations are the most realistic exposure surface. There are no known public exploits, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-hwf3-r46v-5ggx for upstream technical detail.

Detection Methods for CVE-2026-61862

Indicators of Compromise

Unexpected non-printable characters or trailing bytes appearing in ImageMagick debug logs generated by identify.
Image files containing malformed or unusually structured color, ICC, IPTC, or XMP profile segments submitted to processing endpoints.
Recurring identify -verbose or -debug invocations against externally supplied images.

Detection Strategies

Inventory installed ImageMagick binaries and libraries and compare versions against 7.1.2-26 and 6.9.13-51.
Audit application code, cron jobs, and container images for invocations of identify combined with -debug or MAGICK_DEBUG environment settings.
Review upload pipelines for profile-manipulating tooling and inspect samples for unusual profile lengths.

Monitoring Recommendations

Forward ImageMagick debug and error logs to a centralized log platform for anomaly review.
Alert on process executions of identify, magick, or convert with debug flags on production systems.
Track package updates for imagemagick and imagemagick-6-common across managed hosts.

How to Mitigate CVE-2026-61862

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-26 or 6.9.13-51 or later on all affected systems.
Disable debug output for ImageMagick in production image processing workflows.
Restrict who can supply images to services that invoke identify with elevated logging.

Patch Information

Upstream fixes are tracked in the ImageMagick GitHub Security Advisory GHSA-hwf3-r46v-5ggx. Additional context is available in the VulnCheck advisory on ImageMagick information disclosure via identify. Apply distribution package updates as they become available for your operating system.

Workarounds

Do not enable ImageMagick debug output in environments processing untrusted images.
Strip or normalize image profiles before passing files to identify using a sanitizer.
Run ImageMagick under a restrictive policy.xml that limits processed coders and resource usage.

bash

# Verify installed ImageMagick version
identify -version

# Ensure MAGICK_DEBUG is not set in production shells and services
unset MAGICK_DEBUG

# Example policy.xml hardening entry
# <policy domain="coder" rights="none" pattern="EPHEMERAL,URL,HTTPS,HTTP,MVG,MSL,TEXT,SHOW,WIN,PLT" />