VULNERABILITY INTELLIGENCE

CVE-2026-61857

CVSS score3.7 LOW
EPSS probability0.27%
CISA KEVNot currently listed
Published2026-07-11
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

Weakness classification

  • disclosure@vulncheck.com: CWE-252

Primary references