CVE-2026-61868 Overview
CVE-2026-61868 is a memory leak vulnerability in ImageMagick affecting versions before 7.1.2-26 and 6.9.x before 6.9.13-51. The flaw resides in the YUV decoder and triggers when the opening of the image blob fails. Each failed decode attempt leaks allocated memory that the process never reclaims. Repeated invocation against a vulnerable ImageMagick instance drives resource exhaustion and results in denial of service. The weakness is classified as [CWE-401] Missing Release of Memory after Effective Lifetime. ImageMagick is widely embedded in web pipelines, image conversion services, and content management platforms, extending the exposure surface to any application that processes untrusted YUV input.
Critical Impact
Attackers can trigger repeated failed YUV blob operations to exhaust process memory and cause denial of service in any service that processes untrusted images through ImageMagick.
Affected Products
- ImageMagick versions before 7.1.2-26
- ImageMagick 6.9.x versions before 6.9.13-51
- Applications and services embedding vulnerable ImageMagick builds for image processing
Discovery Timeline
- 2026-07-15 - CVE-2026-61868 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-61868
Vulnerability Analysis
The defect exists in the YUV image decoder within ImageMagick. When the decoder attempts to open the input blob and the operation fails, the error path does not free memory that was previously allocated. Each failed decode leaves an unreleased allocation attached to the process heap. Under a sustained request pattern, memory usage grows without bound until the operating system terminates the process or the host runs out of available memory. The weakness is a classic memory management fault where the cleanup routine is skipped on the failure branch. Fixed builds add the missing deallocation calls on all exit paths of the YUV ReadImage routine. Details are documented in the ImageMagick GitHub Security Advisory.
Root Cause
The root cause is missing release of memory after effective lifetime [CWE-401] in the YUV coder. Resource allocations performed before the blob-open check are not paired with a corresponding free when the blob-open operation returns an error. Control transfers away from the allocation site without executing the cleanup logic.
Attack Vector
An attacker submits crafted YUV inputs, or references that cause blob acquisition to fail, to any endpoint that hands data to ImageMagick. No authentication or user interaction is required when the target exposes an image processing endpoint. Repeated submissions cumulatively exhaust memory. Additional context is available in the VulnCheck Advisory: Memory Leak.
No public proof-of-concept exploit code is available at time of publication. The vulnerability mechanism is described in prose because verified exploit code has not been released.
Detection Methods for CVE-2026-61868
Indicators of Compromise
- Steady, monotonic growth of resident memory in processes hosting ImageMagick such as convert, magick, or embedded library consumers
- Elevated volume of failed YUV decode operations in application logs without corresponding memory release
- Out-of-memory kills or container restarts on image processing workers following bursts of malformed image uploads
Detection Strategies
- Inventory installed ImageMagick versions across servers and containers and flag builds earlier than 7.1.2-26 or 6.9.13-51
- Correlate spikes in upload traffic containing YUV or .yuv extensions with memory pressure metrics on the processing tier
- Instrument application error handlers to log YUV decoder failures and alert on repeated failures from the same source
Monitoring Recommendations
- Track process-level RSS and heap growth for image processing workloads and alert on sustained upward trends
- Monitor container OOMKilled events and pod restarts tied to image conversion services
- Rate-limit image upload endpoints and log source IPs generating repeated decode failures
How to Mitigate CVE-2026-61868
Immediate Actions Required
- Upgrade ImageMagick to version 7.1.2-26 or later, or to 6.9.13-51 or later on the 6.9.x branch
- Rebuild and redeploy any application containers or virtual machines that bundle the vulnerable ImageMagick libraries
- Apply request rate limits and size caps to image upload endpoints exposed to untrusted users
Patch Information
The ImageMagick maintainers released fixed versions 7.1.2-26 and 6.9.13-51 addressing the YUV decoder memory leak. Distribution package maintainers publish backported builds through standard channels. Refer to the ImageMagick GitHub Security Advisory for authoritative patch details and version metadata.
Workarounds
- Disable the YUV coder in the ImageMagick policy configuration file when the format is not required by the application
- Restrict accepted upload formats at the application layer to an allowlist that excludes YUV
- Deploy worker process recycling so image processing workers are periodically restarted, bounding cumulative leak impact
# Disable the YUV coder in /etc/ImageMagick-7/policy.xml
# Add the following inside the <policymap> element
<policy domain="coder" rights="none" pattern="YUV" />
# Verify the coder is disabled
magick identify -list policy | grep -i yuv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
