CVE-2026-61866: ImageMagick DOS Vulnerability

CVE-2026-61866 Overview

CVE-2026-61866 is a memory leak vulnerability in ImageMagick versions before 7.1.2-26. The flaw resides in the JNG encoder and triggers when a blob cannot be opened during image processing. Attackers supply malformed JNG files that fail blob operations, causing the encoder to leak memory on each processing attempt. Repeated exploitation leads to resource exhaustion on the host process.

The issue is tracked under CWE-401: Missing Release of Memory after Effective Lifetime. ImageMagick published details in the GitHub Security Advisory GHSA-99w9-hv66-rfv7.

Critical Impact
Repeated processing of crafted JNG files exhausts memory in the ImageMagick process, degrading availability of services that convert or thumbnail user-supplied images.

Affected Products

ImageMagick versions prior to 7.1.2-26
Applications and services embedding vulnerable ImageMagick builds
Image processing pipelines that accept JNG input

Discovery Timeline

2026-07-15 - CVE-2026-61866 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-61866

Vulnerability Analysis

The vulnerability is a memory leak in the JNG (JPEG Network Graphics) encoder path within ImageMagick. When the encoder attempts to open a blob for output and the operation fails, allocated resources are not released before the error return. Each failed encode operation leaks a portion of heap memory tied to the encoder state.

JNG is a multipart image format that combines JPEG-compressed data with PNG-style chunks. Encoding requires the library to open and manage intermediate blobs. A failed blob open in this code path skips cleanup routines and returns without freeing prior allocations.

The defect maps to [CWE-401]. It does not permit code execution, information disclosure, or integrity impact. The consequence is limited to availability degradation through gradual memory consumption.

Root Cause

The root cause is an error-handling path in the JNG encoder that fails to release memory when BlobToImage or an equivalent blob-open operation returns a failure. Cleanup logic is bypassed on the error return, leaving allocated structures orphaned in the process heap.

Attack Vector

Exploitation requires local access and the ability to submit JNG files to a process that invokes the ImageMagick JNG encoder. Automated pipelines such as web-facing image converters can amplify local exposure when they accept attacker-controlled input. Each malformed file triggers a small leak; sustained submission is required to reach exhaustion.

No public proof-of-concept exploit is currently listed for this CVE. The vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is 0.187%.

See the VulnCheck Advisory for additional technical context. No verified exploit code is available; the vulnerability is described here in prose only.

Detection Methods for CVE-2026-61866

Indicators of Compromise

Steady, unexplained growth in resident memory of processes calling convert, magick, or library bindings such as libMagickCore
Repeated ImageMagick error log entries referencing failed blob operations during JNG encoding
Batch submissions of .jng files from a single source to image-processing endpoints

Detection Strategies

Inventory hosts and containers for ImageMagick installations older than 7.1.2-26 using package managers and software bill of materials data
Monitor process memory metrics for image workers and alert on sustained upward trends without corresponding workload increase
Inspect application logs for elevated rates of ImageMagick blob-open failures tied to JNG input

Monitoring Recommendations

Track per-process RSS and virtual memory over rolling windows for image conversion services
Set thresholds on Out-Of-Memory (OOM) kill events for containers running ImageMagick
Correlate spikes in .jng file uploads with worker restarts or degraded service metrics

How to Mitigate CVE-2026-61866

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-26 or later on all systems
Rebuild and redeploy container images that bundle ImageMagick as a dependency
Restrict input formats accepted by image processing services to those required by the application

Patch Information

The fix is delivered in ImageMagick 7.1.2-26. Refer to the ImageMagick GitHub Security Advisory GHSA-99w9-hv66-rfv7 for commit references and release notes. Linux distributions typically ship patched builds through their standard package channels; verify the installed version after updating.

Workarounds

Disable JNG coder support in policy.xml if the format is not required by the workload
Enforce resource limits such as MAGICK_MEMORY_LIMIT and MAGICK_MAP_LIMIT to cap per-process consumption
Run ImageMagick under a process supervisor that recycles workers after a defined memory threshold

bash

# Configuration example: disable JNG coder in ImageMagick policy.xml
# File: /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="JNG" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="map" value="512MiB" />
</policymap>