Memory leak in ImageMagick - CVE-2026-61871

Vulnerability identifier: #VU135689

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-61871

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after effective lifetime in the ICON decoder when handling an allocation failure. A remote attacker can trigger allocation failure during processing to cause a denial of service.

ImageMagick
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
Development Tools Module
Anolis OS
perl-PerlMagick-debuginfo
libMagickCore-7_Q16HDRI10-debuginfo
ImageMagick-devel
libMagick++-7_Q16HDRI5-debuginfo
ImageMagick-config-7-upstream-secure
ImageMagick-config-7-upstream-websafe
ImageMagick-config-7-upstream-limited
ImageMagick-config-7-upstream-open
libMagick++-7_Q16HDRI5
libMagick++-devel
ImageMagick-debuginfo
perl-PerlMagick
ImageMagick-debugsource
libMagickWand-7_Q16HDRI10
libMagickWand-7_Q16HDRI10-debuginfo
libMagickCore-7_Q16HDRI10
ImageMagick-config-7-SUSE
ImageMagick
ImageMagick-c++
ImageMagick-c++-devel
ImageMagick-djvu
ImageMagick-doc
ImageMagick-libs
ImageMagick-perl

Install security update from vendor's website.

ImageMagick - addressed in versions 6.9.13-51, 7.1.2-26
perl-PerlMagick-debuginfo - update to 7.1.1.43-150700.3.70.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.70.1
ImageMagick-devel - update to 7.1.1.43-150700.3.70.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.1.43-150700.3.70.1
ImageMagick-config-7-upstream-secure - update to 7.1.1.43-150700.3.70.1
ImageMagick-config-7-upstream-websafe - update to 7.1.1.43-150700.3.70.1
ImageMagick-config-7-upstream-limited - update to 7.1.1.43-150700.3.70.1
ImageMagick-config-7-upstream-open - update to 7.1.1.43-150700.3.70.1
libMagick++-7_Q16HDRI5 - update to 7.1.1.43-150700.3.70.1
libMagick++-devel - update to 7.1.1.43-150700.3.70.1
ImageMagick-debuginfo - update to 7.1.1.43-150700.3.70.1
perl-PerlMagick - update to 7.1.1.43-150700.3.70.1
ImageMagick-debugsource - update to 7.1.1.43-150700.3.70.1
libMagickWand-7_Q16HDRI10 - update to 7.1.1.43-150700.3.70.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.1.43-150700.3.70.1
libMagickCore-7_Q16HDRI10 - update to 7.1.1.43-150700.3.70.1
ImageMagick-config-7-SUSE - update to 7.1.1.43-150700.3.70.1
ImageMagick - update to 7.1.1.43-150700.3.70.1
ImageMagick - update to 7.1.2.27-1
ImageMagick-c++ - update to 7.1.2.27-1
ImageMagick-c++-devel - update to 7.1.2.27-1
ImageMagick-devel - update to 7.1.2.27-1
ImageMagick-djvu - update to 7.1.2.27-1
ImageMagick-doc - update to 7.1.2.27-1
ImageMagick-libs - update to 7.1.2.27-1
ImageMagick-perl - update to 7.1.2.27-1

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84

• Multiple vulnerabilities in ImageMagick
• SUSE update for ImageMagick
• Anolis OS update for ImageMagick