CVE-2026-61872 Overview
CVE-2026-61872 is a memory leak vulnerability in ImageMagick affecting the TIFF encoder [CWE-401]. The flaw exists in versions prior to 7.1.2-26 and 6.9.13-51. When a caller supplies an invalid tiff:tile-geometry parameter, the encoder fails to release allocated memory. Repeated processing of malformed inputs causes memory consumption to grow over time.
The vulnerability requires local access, high attack complexity, and user interaction to trigger. Impact is limited to availability degradation on the affected host. No confidentiality or integrity impact has been reported.
Critical Impact
Sustained processing of malformed TIFF tile geometry parameters can exhaust host memory, degrading service availability on systems that programmatically convert untrusted images with ImageMagick.
Affected Products
- ImageMagick versions before 7.1.2-26
- ImageMagick 6.x versions before 6.9.13-51
- Applications and services embedding vulnerable ImageMagick builds for TIFF encoding
Discovery Timeline
- 2026-07-15 - CVE-2026-61872 published to the National Vulnerability Database
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-61872
Vulnerability Analysis
The defect resides in the TIFF encoder path within ImageMagick. When encoding a TIFF image, callers can specify tiling behavior through the tiff:tile-geometry define. If the supplied geometry string is malformed or otherwise invalid, the encoder allocates internal buffers but does not free them before returning an error.
Each invocation with an invalid geometry parameter leaks a bounded amount of heap memory. In short-lived command-line invocations the leak is inconsequential. In long-running services, such as image processing daemons or web upload pipelines, repeated calls accumulate leaked allocations. Over time this reduces free memory available to the host process and other workloads.
The issue is classified as a Missing Release of Memory after Effective Lifetime [CWE-401]. It does not corrupt memory or permit code execution.
Root Cause
The TIFF encoder validates the tiff:tile-geometry argument after resources have already been allocated for tile setup. The error handling path returns to the caller without invoking the corresponding deallocation routines. The fix, distributed in ImageMagick 7.1.2-26 and 6.9.13-51, releases the allocated structures on the invalid-geometry error branch.
Attack Vector
An attacker requires local access to a system that will invoke ImageMagick on attacker-influenced input. The attacker supplies a TIFF conversion request with a crafted invalid tiff:tile-geometry value. User interaction is required, and attack complexity is high because the leak per invocation is small.
Exploitation is only practically impactful against automated pipelines that process many attacker-controlled files or repeatedly re-invoke the encoder as part of a batch workflow. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Memory Leak for additional context.
Detection Methods for CVE-2026-61872
Indicators of Compromise
- Gradual, monotonic growth of resident set size (RSS) for processes that invoke ImageMagick TIFF encoding
- Repeated ImageMagick error messages referencing invalid tile geometry in application or stderr logs
- Batch jobs or image-conversion workers restarting or being OOM-killed with no other apparent cause
Detection Strategies
- Inventory hosts and containers for ImageMagick binaries older than 7.1.2-26 or 6.9.13-51 using package managers or file version scans
- Instrument image-processing services with heap usage metrics and alert on trend-based growth over time
- Review application logs for calls that pass a tiff:tile-geometry define originating from untrusted input
Monitoring Recommendations
- Track per-process memory over multi-hour windows for convert, magick, and any service linking libMagickCore
- Correlate memory growth with volume of TIFF encode operations to distinguish this leak from unrelated pressure
- Forward host memory and OOM-kill events into a centralized log platform for retrospective analysis
How to Mitigate CVE-2026-61872
Immediate Actions Required
- Upgrade ImageMagick to 7.1.2-26 or later, or to 6.9.13-51 or later on the 6.x branch
- Rebuild container images and redeploy any workload that ships ImageMagick as a dependency
- Restart long-running image-processing services after upgrade to release previously leaked memory
Patch Information
The upstream project has published fixed builds in ImageMagick 7.1.2-26 and 6.9.13-51. Full details are documented in the GitHub Security Advisory GHSA-h5r4-w88w-7ccr. Linux distributions are expected to backport the fix into their supported ImageMagick packages.
Workarounds
- Reject or sanitize the tiff:tile-geometry define when accepting image conversion parameters from untrusted callers
- Enforce per-process memory limits with ulimit, systemdMemoryMax, or container cgroup constraints so leaks terminate the worker before affecting the host
- Recycle image-processing workers after a fixed number of requests to bound cumulative leakage until patching is complete
# Configuration example: cap memory for an ImageMagick worker via systemd
[Service]
MemoryMax=512M
Restart=always
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
