{"id":"CVE-2026-61870","state":"PUBLISHED","title":"ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder","description":"ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.","publishedAt":"2026-07-11T13:01:09.995Z","updatedAt":"2026-10-29T21:16:15.828Z","severity":{"score":2.1,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["ImageMagick ImageMagick"],"affected":[{"vendor":"ImageMagick","product":"ImageMagick","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.1.2-26","versionType":"semver"},{"version":"7.1.2-26","status":"unaffected","versionType":"semver"}]},{"vendor":"ImageMagick","product":"ImageMagick","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.9.13-51","versionType":"semver"},{"version":"6.9.13-51","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-via-viff-encoder"],"weaknesses":["CWE-401"],"ingestedAt":"2026-10-29T23:12:04.845Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/61xxx/CVE-2026-61870.json","commit":"dc7676b3f67d6707e4927968546e7e0125ff7ec7","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-61870","state":"PUBLISHED","datePublished":"2026-07-11T13:01:09.995Z","dateUpdated":"2026-10-29T21:16:15.828Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-07-10T21:54:26.760Z"},"containers":{"cna":{"title":"ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder","descriptions":[{"lang":"en","value":"ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service."}],"affected":[{"vendor":"ImageMagick","product":"ImageMagick","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.1.2-26","versionType":"semver"},{"version":"7.1.2-26","status":"unaffected","versionType":"semver"}]},{"vendor":"ImageMagick","product":"ImageMagick","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.9.13-51","versionType":"semver"},{"version":"6.9.13-51","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh","name":"GitHub Security Advisory (GHSA-m596-67p7-69wh)","tags":["vendor-advisory"]},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-via-viff-encoder","name":"VulnCheck Advisory: ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":2.1,"baseSeverity":"LOW"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":2.9,"baseSeverity":"LOW"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-401","lang":"en","description":"Missing Release of Memory after Effective Lifetime","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-29T21:16:15.828Z"},"datePublic":"2026-06-26T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.2-26","versionStartIncluding":"7.0.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9.13-51"}]}]}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-13T16:09:14.622804Z","id":"CVE-2026-61870","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-13T16:09:19.684Z"}}]}}}