Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-11T13:01:07 ImageMagick: ImageMagick: Application crashes via malicious XMP profiles 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-476

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

A flaw was found in ImageMagick. This vulnerability allows a remote attacker to cause the application to crash. The issue stems from improper handling of XMP (Extensible Metadata Platform) profiles within image files. By crafting a malicious image with specially designed XMP data, an attacker can trigger a heap use-after-free condition, leading to a denial of service.

Red Hat Enterprise Linux 6 Out of support scope ImageMagick Red Hat Enterprise Linux 7 Out of support scope ImageMagick https://www.cve.org/CVERecord?id=CVE-2026-61857 https://nvd.nist.gov/vuln/detail/CVE-2026-61857 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j https://www.vulncheck.com/advisories/imagemagick-before-26-heap-use-after-free-via-xmp