CVE-2026-61857
LOWDescription
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
Is your site exposed to CVE-2026-61857?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| imagemagick | imagemagick |
| imagemagick | imagemagick |
References
Frequently Asked Questions
What is CVE-2026-61857? +
How severe is CVE-2026-61857? +
What products are affected by CVE-2026-61857? +
How do I check if I'm vulnerable to CVE-2026-61857? +
Related Vulnerabilities
The Ember ZNet stack’s packet buffer manager may read out of bound memory leading to an assert, causing a Denial …
An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary …
An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an …
Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that …
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table …
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic …