Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-15T11:25:52 ImageMagick: ImageMagick: Denial of Service due to memory leak in TIFF encoder 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-772

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.

A flaw was found in ImageMagick. A remote attacker could exploit a memory leak vulnerability within the TIFF encoder. By processing specially crafted TIFF images, an attacker can trigger memory allocation failures, leading to memory exhaustion. This can result in a denial of service (DoS), making the affected system or application unavailable.

Red Hat Enterprise Linux ships ImageMagick in RHEL 6 ELS and RHEL 7 ELS. This flaw has been rated as having a Low security impact and is not currently planned to be addressed in future updates of those products. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Do not process untrusted image files with ImageMagick. If processing of untrusted input is required, configure ImageMagick's policy.xml to set memory and map resource limits to contain the impact of potential memory leaks. Upgrade to ImageMagick 7.1.2-26 or 6.9.13-51 mitigates the issue. Red Hat Enterprise Linux 6 Fix deferred ImageMagick Red Hat Enterprise Linux 7 Fix deferred ImageMagick https://www.cve.org/CVERecord?id=CVE-2026-61867 https://nvd.nist.gov/vuln/detail/CVE-2026-61867 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jfq9-q63x-rc63 https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-in-tiff-encoder-2