CVE-2026-61865: ImageMagick Memory Leak DOS Vulnerability

CVE-2026-61865 Overview

CVE-2026-61865 is a memory leak vulnerability in ImageMagick, an open-source image processing suite. The flaw resides in the Hough lines operation, where a specific failure condition results in a small amount of unreleased memory. The issue affects ImageMagick versions prior to 7.1.2-26 and 6.9.13-51. The vulnerability is classified under CWE-401: Missing Release of Memory after Effective Lifetime.

Critical Impact
The vulnerability enables a local, low-severity resource exhaustion condition through repeated triggering of the failing Hough lines operation. It does not affect confidentiality or integrity.

Affected Products

ImageMagick versions prior to 7.1.2-26
ImageMagick 6.x versions prior to 6.9.13-51
Applications and services embedding vulnerable ImageMagick libraries

Discovery Timeline

2026-07-15 - CVE-2026-61865 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61865

Vulnerability Analysis

The vulnerability exists in the Hough lines transform functionality within ImageMagick. When the operation encounters a specific failure path, allocated memory is not properly released before the function returns. Each failed invocation leaks a small amount of heap memory. Attackers with local access who can submit crafted inputs may trigger the leak repeatedly to degrade process memory availability over time.

The defect maps to CWE-401, which covers cases where an allocated resource is not freed after its effective lifetime. While each individual leak is small, long-running ImageMagick processes or service workers that repeatedly process untrusted images may accumulate the leaked memory, eventually impacting availability.

Root Cause

The Hough lines operation contains a code path that fails to invoke the corresponding deallocation routine when an internal operation returns an error. Control flow exits the function without releasing the previously allocated buffer. Details of the affected routines are documented in the ImageMagick GitHub Security Advisory.

Attack Vector

Exploitation requires local access and the ability to submit input that reaches the Hough lines code path. The attack complexity is high, and successful exploitation results only in limited availability impact through gradual memory consumption. Refer to the VulnCheck Advisory for additional context. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-61865

Indicators of Compromise

Gradual, unexplained growth in resident memory of processes invoking ImageMagick
Repeated failures logged by ImageMagick when invoking the Hough lines transform
Out-of-memory events in long-running image processing workers

Detection Strategies

Inventory hosts and containers for ImageMagick versions below 7.1.2-26 and 6.9.13-51 using software composition analysis tools
Monitor process memory metrics for image processing services and alert on abnormal growth patterns
Review application logs for ImageMagick error messages associated with Hough lines processing failures

Monitoring Recommendations

Collect and centralize process memory telemetry from image processing hosts for trend analysis
Enable resource-usage alerts on container orchestration platforms hosting ImageMagick workloads
Track ImageMagick package versions through configuration management and vulnerability scanning

How to Mitigate CVE-2026-61865

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-26 or later, or to 6.9.13-51 for the 6.x branch
Restart services and workers that load ImageMagick libraries after patching to clear any accumulated leaked memory
Restrict local access to systems processing untrusted images to trusted users only

Patch Information

Fixed versions are ImageMagick 7.1.2-26 and ImageMagick 6.9.13-51. Patch details and commit references are published in the ImageMagick GitHub Security Advisory. Distribution maintainers should backport the fix to supported LTS package versions.

Workarounds

Disable or restrict the Hough lines operation in ImageMagick policy configuration if not required
Enforce per-process memory limits using cgroups or systemd resource controls to bound impact
Recycle long-running image processing workers on a scheduled basis to release accumulated memory

bash

# Configuration example: restrict Hough lines usage in ImageMagick policy.xml
# /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
  <policy domain="filter" rights="none" pattern="HoughLines"/>
</policymap>