CVE-2026-61871: ImageMagick ICON Decoder DoS Vulnerability

CVE-2026-61871 Overview

CVE-2026-61871 is a memory leak vulnerability in the ImageMagick ICON decoder. The flaw affects ImageMagick versions before 7.1.2-26 and 6.9.13-51. When the decoder encounters a failed memory allocation while processing a crafted ICON file, it fails to release previously allocated memory. Repeated processing of malicious ICON files can exhaust available memory and cause a denial of service.

The vulnerability is categorized under [CWE-401] (Missing Release of Memory after Effective Lifetime). It requires no authentication and can be triggered remotely wherever ImageMagick processes untrusted ICON input, such as web-based image conversion services.

Critical Impact
Attackers can trigger repeated memory leaks in ImageMagick server processes, leading to resource exhaustion and denial of service on hosts that decode untrusted ICON files.

Affected Products

ImageMagick versions prior to 7.1.2-26
ImageMagick 6.x versions prior to 6.9.13-51
Applications and services embedding vulnerable ImageMagick builds for image processing

Discovery Timeline

2026-07-15 - CVE-2026-61871 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61871

Vulnerability Analysis

The defect resides in the ICON coder module of ImageMagick, which parses Windows icon files containing one or more embedded images. During parsing, the decoder allocates buffers to hold pixel data, palette entries, and per-frame metadata. When one of these allocation calls fails, the code path taken to handle the failure does not free buffers that were successfully allocated earlier in the same operation.

Each crafted ICON file that triggers this allocation-failure path leaks a portion of heap memory. Because ImageMagick is commonly deployed inside long-running server processes such as web application backends, print servers, and content pipelines, the leak accumulates over time. Sustained processing of malicious ICON inputs degrades service availability and can force process termination by the operating system's out-of-memory killer.

Root Cause

The root cause is an incomplete error-handling path in the ICON decoder. When an allocation call inside the decoder returns a failure indicator, the function returns early without invoking the cleanup routines that would normally release earlier allocations. This maps directly to [CWE-401], where memory allocated on one branch is never freed on the error branch.

Attack Vector

Exploitation requires an attacker to submit or upload a crafted .ico file to an application that uses ImageMagick for decoding. The attack vector is network-reachable in any workflow that accepts user-supplied images, including avatar uploads, favicon processors, thumbnail generators, and document conversion services. No authentication or user interaction is required beyond delivering the file to the decoder.

The vulnerability does not permit code execution or data disclosure. Its practical impact is limited to availability degradation, but the attack can be repeated indefinitely with minimal bandwidth. Full technical detail is available in the GitHub Security Advisory and the VulnCheck Advisory on ImageMagick.

Detection Methods for CVE-2026-61871

Indicators of Compromise

Steadily increasing resident set size (RSS) of processes that invoke ImageMagick binaries such as convert, magick, or identify
Repeated ICON file uploads or conversion requests from a single source targeting image-processing endpoints
Out-of-memory kills or restarts of web worker processes that call ImageMagick libraries

Detection Strategies

Inventory installed ImageMagick versions across servers and containers, flagging any build older than 7.1.2-26 or 6.9.13-51
Instrument image-processing services with heap usage metrics and alert on abnormal growth patterns correlated with ICON parsing
Inspect application logs for ImageMagick warnings or errors emitted from the ICON coder during file decoding

Monitoring Recommendations

Track per-request memory consumption of image conversion workers and baseline normal ICON processing behavior
Alert on repeated submissions of .ico files from the same client IP or session within short time windows
Monitor systemd or container orchestrator restart counts for services that embed ImageMagick

How to Mitigate CVE-2026-61871

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-26 or later, or 6.9.13-51 or later for the 6.x branch
Rebuild and redeploy any application containers that bundle ImageMagick as a static or shared dependency
Restrict accepted image formats at the application layer to exclude ICON files where they are not required

Patch Information

Patched releases are available from the ImageMagick project. Fixed versions are 7.1.2-26 and 6.9.13-51. Refer to the GitHub Security Advisory for commit references and distribution-specific update guidance.

Workarounds

Disable the ICON coder in ImageMagick's policy.xml if ICON decoding is not needed by production workflows
Enforce strict per-request memory and CPU limits on image-processing workers using cgroups or container resource constraints
Place image upload endpoints behind rate limiting to reduce the practical impact of repeated malicious submissions

bash

# Example: disable the ICON coder in ImageMagick policy.xml
# Add the following inside the <policymap> element
<policy domain="coder" rights="none" pattern="ICON" />