CVE-2026-61870 Overview
CVE-2026-61870 is a memory leak vulnerability in ImageMagick versions before 7.1.2-26. The flaw resides in the Visualization Image File Format (VIFF) encoder and is triggered when internal memory allocation calls fail during image processing. An attacker who can submit a specially crafted VIFF image to a vulnerable ImageMagick instance can force repeated allocation failures, causing the encoder to leak memory on each invocation. Over time, this exhausts available memory and results in denial of service on the host system. The issue is tracked as CWE-401: Missing Release of Memory after Effective Lifetime.
Critical Impact
Local attackers can exhaust process memory by submitting crafted VIFF images to ImageMagick, degrading or denying service to any application relying on the library for image conversion.
Affected Products
- ImageMagick versions prior to 7.1.2-26
- Applications and services embedding vulnerable ImageMagick builds for VIFF image handling
- Linux distributions and container images shipping unpatched ImageMagick packages
Discovery Timeline
- 2026-07-11 - CVE-2026-61870 published to the National Vulnerability Database
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-61870
Vulnerability Analysis
The vulnerability affects the VIFF encoder inside ImageMagick, an open-source image processing library used across web services, media pipelines, and command-line utilities. When the encoder attempts to allocate buffers required to serialize a VIFF image, it does not consistently free previously allocated resources if a subsequent allocation call fails. Each failed encoding operation leaves orphaned memory in the process heap. Attackers who repeatedly submit crafted VIFF inputs designed to trigger allocation failures can grow the leaked footprint until the process is terminated by the operating system or becomes unresponsive.
The attack requires local access and high attack complexity, and its impact is limited to availability. There is no confirmed exploitation in the wild and no public proof-of-concept has been released.
Root Cause
The root cause is missing cleanup logic on error paths inside the VIFF encoder implementation. When an intermediate AcquireQuantumMemory or equivalent allocation returns a null pointer, the encoder exits the routine without releasing prior allocations tied to the same encoding pass. This violates the standard resource-lifetime contract described in CWE-401.
Attack Vector
Exploitation requires the attacker to influence input passed to a process using ImageMagick, either through a local shell, a batch conversion job, or an application that accepts user-supplied images and invokes VIFF conversion. The attacker submits a crafted VIFF file, or a file that ImageMagick converts to VIFF, and forces repeated allocation failures. No authentication or user interaction is required on the target process itself. Successful exploitation degrades service availability rather than compromising confidentiality or integrity.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-m596-67p7-69wh and the VulnCheck Advisory for maintainer-provided technical details.
Detection Methods for CVE-2026-61870
Indicators of Compromise
- Sustained growth of resident set size (RSS) for processes linked against libMagickCore or invoking the magick or convert binaries.
- Repeated VIFF-format conversion requests in application logs, particularly from a single source or session.
- OutOfMemory or oom-killer events targeting image processing workers shortly after VIFF input handling.
Detection Strategies
- Inventory installed ImageMagick versions across servers, containers, and build images, and flag any release earlier than 7.1.2-26.
- Monitor calls to ImageMagick binaries with arguments referencing .viff or viff: coders and correlate with process memory growth.
- Enable ImageMagick logging via policy.xml to capture coder invocations and error paths triggered by malformed inputs.
Monitoring Recommendations
- Track per-process memory metrics for image conversion services and alert on sustained upward trends without corresponding workload increases.
- Aggregate kernel oom_kill events and application crash logs into a central logging platform for trend analysis.
- Review web application logs for uploads of unusual image types, including VIFF, from untrusted users.
How to Mitigate CVE-2026-61870
Immediate Actions Required
- Upgrade ImageMagick to version 7.1.2-26 or later on all systems processing untrusted image input.
- Rebuild container images and application bundles that statically include vulnerable ImageMagick libraries.
- Restrict acceptance of VIFF and other rarely used image formats where they are not required by the application.
Patch Information
The ImageMagick maintainers released the fix in version 7.1.2-26, addressing the missing memory release on failed allocations within the VIFF encoder. Distribution package maintainers have published backported updates; consult vendor advisories for the specific package version. Full remediation details are available in the GitHub Security Advisory GHSA-m596-67p7-69wh.
Workarounds
- Disable the VIFF coder in policy.xml using a policy such as <policy domain="coder" rights="none" pattern="VIFF"/> until patching is complete.
- Enforce per-process memory limits using ulimit, systemd MemoryMax, or container resource limits to contain leaks.
- Validate and constrain the set of accepted image formats at the application layer before passing input to ImageMagick.
# Configuration example: disable the VIFF coder in ImageMagick policy.xml
# Location typically: /etc/ImageMagick-7/policy.xml
<policymap>
<policy domain="coder" rights="none" pattern="VIFF" />
</policymap>
# Verify installed ImageMagick version
magick -version | head -n 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
