CVE-2026-61857: ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP
Published Jul 11, 2026
·Updated
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
Affected Software
3 affected components
ImageMagick ImageMagick<7.1.2-26
ImageMagick ImageMagick<6.9.13-51
ImageMagick ImageMagick>=7.0.0-0<7.1.2-26
Event History
Jul 11, 2026
CVE Published
via MITRE·01:01 PM
Data Sourced
via MITRE·01:01 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-61857?
The severity of CVE-2026-61857 is rated low, with a score of 3.7.
2
How do I fix CVE-2026-61857?
To fix CVE-2026-61857, upgrade ImageMagick to version 7.1.2-26 or later.
3
What type of vulnerability is CVE-2026-61857?
CVE-2026-61857 is classified as a heap use-after-free vulnerability.
4
What attacks can exploit CVE-2026-61857?
Attackers can exploit CVE-2026-61857 by crafting malicious image files with specially formatted XMP data.
5
What versions of ImageMagick are affected by CVE-2026-61857?
ImageMagick versions prior to 7.1.2-26 are affected by CVE-2026-61857.