CVE-2026-61464

What it actually does

ImageMagick versions before 7.1.2-26 and 6.9.13-51 contain a heap-based buffer overwrite in the X11 import functionality. When ImageMagick imports an X11 window whose title is specially crafted, memory adjacent to the heap buffer can be overwritten, causing heap corruption. Based on the published scoring, the expected impact is limited to local denial of service through process crash or instability; confidentiality and integrity impact are not indicated.

Why it matters to the business

The most likely business impact is disruption of systems, scripts, or desktop workflows that use ImageMagick to capture X11 windows or screenshots. Exploitation requires local access, high privileges, user interaction, and a crafted X11 window title, so broad internet-scale exploitation is unlikely. The vulnerability is not listed in CISA KEV, has very low EPSS, no known exploit maturity, and is not reported as used in ransomware campaigns, which lowers urgency compared with remotely exploitable flaws.

How an attack unfolds

An attacker first needs access to an X11 environment where they can create or influence a window title. They craft a maliciously formatted window title and then cause ImageMagick's X11 import feature to process that window, for example by inducing a privileged user or automation task to run ImageMagick import against the attacker-controlled window. During parsing or handling of the crafted title, ImageMagick writes beyond the intended heap buffer, corrupting process memory. The practical result is expected to be a crash or denial of service of the ImageMagick process rather than reliable code execution, given the published impact assessment and exploit prerequisites.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-26 or later for the 7.x branch, or 6.9.13-51 or later for the 6.x branch. Where immediate upgrade is not possible, avoid using ImageMagick X11 import against untrusted or attacker-controlled windows, restrict access to X11 sessions, and run screenshot/import automation with least privilege. For packaged distributions, apply the vendor-provided ImageMagick security update rather than relying only on upstream version numbers, because downstream packages may backport fixes.

How to confirm the fix worked

Confirm the installed ImageMagick version is 7.1.2-26 or later, 6.9.13-51 or later, or a vendor package that explicitly includes the fix for this issue. Validate both the `magick` and legacy `import` binaries where present. Review package manager metadata, container images, workstation builds, and automation hosts for older ImageMagick packages. If X11 import functionality is required, perform a controlled regression test after upgrade to confirm screenshot/import workflows still operate normally and no crash occurs when handling unusual window titles.

Typical attack path

1. Gain local access to a system or session where X11 window titles can be controlled or influenced.
2. Create an X11 window with a specially crafted title designed to trigger the heap overwrite.
3. Cause a privileged user, script, or automation process to run ImageMagick X11 import against the crafted window.
4. ImageMagick processes the malicious window title and corrupts heap memory.
5. The ImageMagick process crashes or becomes unstable, causing denial of service for the associated workflow.

How to detect it

There are no public reports of active exploitation and no known threat actors associated with this issue. To assess possible prior exploitation, review endpoint process telemetry, shell history, audit logs, systemd journal entries, crash reporting, and core dump repositories for executions of ImageMagick X11 import followed by crashes such as segmentation faults, aborts, or heap corruption errors. Focus on systems where X11 is used and where untrusted users can create windows or influence window titles. Useful evidence includes `import` or `magick import` invocations targeting X11 displays, anomalously long or non-printable X11 window titles, repeated ImageMagick crashes, and core dumps associated with the ImageMagick import process. Because the expected impact is denial of service, absence of persistent artifacts does not rule out exploitation; prioritize crash correlation and local session activity around the time of failures.

• process_name=import
• process_name=magick
• command_line="magick import"
• command_line="import -window"
• command_line="import root"
• Segmentation fault
• SIGSEGV
• heap corruption
• corrupted double-linked list
• malloc(): memory corruption
• systemd-coredump
• core.import
• core.magick

What your security team should do

• Inventory systems, containers, and workstation images that include ImageMagick, especially those using X11 screenshot or window import functionality.
• Prioritize upgrades on shared workstations, jump hosts, build systems, automation hosts, and any environment where untrusted users can create X11 windows.
• Upgrade to ImageMagick 7.1.2-26 or later, 6.9.13-51 or later, or the corresponding fixed vendor package.
• Restrict X11 access and avoid running ImageMagick import workflows with elevated privileges.
• Monitor for ImageMagick import crashes, core dumps, or repeated segmentation faults in environments where X11 import is used.
• Treat this as lower urgency than remotely exploitable KEV-listed vulnerabilities, but include it in normal patch cycles because it can disrupt local workflows.