CVE-2026-61867: ImageMagick TIFF Encoder DoS Vulnerability

CVE-2026-61867 Overview

CVE-2026-61867 is a memory leak vulnerability in ImageMagick versions before 7.1.2-26. The flaw resides in the TIFF encoder when memory allocation fails during image processing. Attackers can trigger repeated allocation failures to exhaust available memory and cause a denial of service on the host application.

The issue is classified under CWE-401: Missing Release of Memory after Effective Lifetime. Exploitation requires local access and high attack complexity, limiting the practical risk to environments that process untrusted TIFF images through ImageMagick pipelines.

Critical Impact
Successful exploitation causes memory exhaustion in the ImageMagick process, resulting in denial of service for applications relying on TIFF encoding.

Affected Products

ImageMagick versions prior to 7.1.2-26
Applications and services embedding vulnerable ImageMagick builds for TIFF processing
Linux and Unix-like distributions packaging affected ImageMagick releases

Discovery Timeline

2026-07-15 - CVE-2026-61867 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61867

Vulnerability Analysis

The vulnerability affects the TIFF encoder component of ImageMagick. When the encoder allocates memory buffers during image conversion, failure paths do not release previously allocated resources. Each failed encoding operation leaks memory into the process heap.

An attacker with local access can submit crafted TIFF images or trigger conditions that force allocation failures. Repeated invocation drains available memory until the process or host becomes unresponsive. The impact is limited to availability, with no confidentiality or integrity consequences.

Because ImageMagick is commonly embedded in web applications, document processors, and automated media pipelines, the leak can propagate into long-running server processes. Environments that queue large volumes of image conversions are the most exposed.

Root Cause

The root cause is missing cleanup logic in the TIFF encoder error-handling branches. When AcquireMagickMemory or related allocator calls fail mid-encoding, allocated intermediate buffers remain referenced but unreachable. This matches the CWE-401 pattern of failing to release memory before losing the last reference.

Attack Vector

Exploitation requires local access to a process invoking the ImageMagick TIFF encoder. The attacker supplies input or environmental conditions that induce allocation failure during encoding. Attack complexity is high because reliably provoking allocator failure typically requires memory pressure or resource limit manipulation.

No authentication is required for the vulnerable code path itself, but the attacker must be able to submit images to the encoder. The vulnerability manifests only in the availability dimension and cannot be used for code execution or data exfiltration. See the GitHub Security Advisory GHSA-jfq9-q63x-rc63 for upstream technical detail.

Detection Methods for CVE-2026-61867

Indicators of Compromise

Progressive resident memory (RSS) growth in processes invoking convert, magick, or library bindings for ImageMagick
Out-of-memory (OOM) killer events terminating ImageMagick worker processes
Repeated failed TIFF encoding operations logged by applications embedding ImageMagick

Detection Strategies

Inventory installed ImageMagick versions across servers and container images and flag any build below 7.1.2-26
Monitor process memory metrics for services performing TIFF encoding and alert on sustained upward trends
Review application logs for repeated TIFFWriteEncodedStrip or allocation failure errors originating from ImageMagick

Monitoring Recommendations

Enable cgroup memory limits on ImageMagick worker processes to expose leaks earlier through controlled OOM events
Collect and centralize process telemetry using a data lake or SIEM to correlate memory pressure with image processing workloads
Track TIFF conversion request volume per source to identify anomalous submission patterns targeting the encoder

How to Mitigate CVE-2026-61867

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-26 or later on all affected systems
Rebuild container images and application bundles that statically link or vendor ImageMagick
Restart long-running services that load ImageMagick libraries to release any leaked memory from prior exploitation attempts

Patch Information

The fix is included in ImageMagick 7.1.2-26. Refer to the ImageMagick GitHub Security Advisory GHSA-jfq9-q63x-rc63 and the VulnCheck advisory for release details and downstream distribution status.

Workarounds

Disable TIFF encoding in ImageMagick policy by editing policy.xml to add <policy domain="coder" rights="none" pattern="TIFF" /> where TIFF output is not required
Enforce per-process memory and CPU limits using systemd resource controls or container quotas to contain leak impact
Restrict which users and services can submit images to ImageMagick encoding pipelines, reducing exposure to untrusted input

bash

# Configuration example: restrict TIFF coder in ImageMagick policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="TIFF" />
  <policy domain="resource" name="memory" value="256MiB" />
  <policy domain="resource" name="map" value="512MiB" />
</policymap>