CVE-2026-61869: ImageMagick MIFF Encoder DoS Vulnerability

CVE-2026-61869 Overview

CVE-2026-61869 is a memory leak vulnerability in ImageMagick affecting versions prior to 7.1.2-26 and 6.9.13-51. The flaw resides in the Magick Image File Format (MIFF) encoder and triggers when a memory allocation fails during MIFF image processing. When the allocation failure occurs, previously allocated memory is not released, resulting in a leak that can lead to denial of service. The issue is classified under CWE-401: Missing Release of Memory after Effective Lifetime. The vulnerability requires local access and has high attack complexity, limiting its practical exploitability.

Critical Impact
Repeated processing of crafted MIFF images under memory pressure can exhaust process memory, degrading service availability on hosts using ImageMagick for image conversion or thumbnail generation.

Affected Products

ImageMagick versions prior to 7.1.2-26
ImageMagick 6.x versions prior to 6.9.13-51
Applications and services embedding vulnerable ImageMagick builds for MIFF encoding

Discovery Timeline

2026-07-15 - CVE-2026-61869 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61869

Vulnerability Analysis

The vulnerability exists in ImageMagick's MIFF encoder, the routine responsible for writing images in the native ImageMagick file format. During encoding, the routine allocates buffers to hold pixel data, compression state, and metadata. When one of these allocations fails, the encoder returns an error path that does not release previously allocated resources.

Each failed encoding attempt leaks a portion of memory. Over time, or under repeated invocation, the leaked memory accumulates and reduces the memory available to the host process. Long-running services that call ImageMagick to process user-supplied images are the most exposed. Local attack complexity is high because triggering the leak requires inducing an allocation failure, typically by exhausting available memory first.

Root Cause

The root cause is missing cleanup on an error path within the MIFF encoder. The code lacks calls to free previously allocated buffers when a subsequent allocation returns failure, matching the pattern described by CWE-401.

Attack Vector

An attacker with local access submits crafted or oversized MIFF images to a service that invokes the ImageMagick MIFF encoder. By influencing conditions under which memory allocation fails, the attacker forces the encoder down the leak path. Repeated submissions gradually consume process memory until the service degrades or crashes. Full technical details are documented in the ImageMagick GitHub Security Advisory GHSA-r628-69v2-2f9c and the VulnCheck Advisory on ImageMagick.

Detection Methods for CVE-2026-61869

Indicators of Compromise

Steadily increasing resident set size (RSS) of processes invoking ImageMagick without corresponding workload growth
convert, magick, or embedded ImageMagick processes terminated by the OOM killer
Repeated MIFF encoding requests in application logs originating from a single source

Detection Strategies

Inventory installed ImageMagick versions across servers and container images to identify builds older than 7.1.2-26 or 6.9.13-51
Monitor per-process memory growth trends for services that call ImageMagick, alerting on sustained increases
Review application logs for high volumes of MIFF format conversions, particularly from untrusted sources

Monitoring Recommendations

Collect process memory metrics and OOM events into a central logging or SIEM platform for baseline comparison
Track ImageMagick command-line invocations and output formats to identify anomalous MIFF encoding activity
Alert on repeated service restarts of image-processing workers, which often indicate memory exhaustion

How to Mitigate CVE-2026-61869

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-26 or 6.9.13-51 or later on all affected systems
Rebuild container images and application bundles that ship a vendored ImageMagick with the patched version
Restrict which image formats untrusted users can submit, disabling MIFF encoding where it is not required

Patch Information

The ImageMagick maintainers resolved the leak in versions 7.1.2-26 and 6.9.13-51. Refer to the ImageMagick GitHub Security Advisory GHSA-r628-69v2-2f9c for the fix commit and release notes.

Workarounds

Use the ImageMagick policy.xml configuration to disable the MIFF coder if it is not needed by the application
Enforce per-process memory limits (for example, ulimit -v or cgroup memory limits) to bound the impact of a leak
Restart long-running image-processing workers on a schedule until patching is complete

bash

# Disable the MIFF coder in ImageMagick policy.xml
# Location: /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="MIFF" />
</policymap>

# Verify installed version
magick -version

# Apply a memory limit to processes invoking ImageMagick
ulimit -v 1048576