CVE-2026-61860

What it actually does

ImageMagick contains a use-after-free condition in versions before 7.1.2-26 and 6.9.13-51 when FreeType initialization fails during image processing. Instead of aborting the code path after initialization failure, ImageMagick continues execution and accesses memory that has already been freed. The currently described impact is low availability impact: a crafted or malformed image-processing input can crash the ImageMagick process or a service that embeds it. The CVSS vector indicates network attackability in services that expose image processing remotely, but with high attack complexity and a required precondition, and no expected confidentiality or integrity impact.

Why it matters to the business

Applications that accept or transform user-supplied images may experience crashes or failed image-processing jobs if they run vulnerable ImageMagick versions. In practice, this can disrupt uploads, thumbnail generation, document conversion, media pipelines, or background workers, but the published scoring and EPSS value indicate relatively low exploitation likelihood and limited business impact compared with remote code execution flaws. Organizations with high-volume public upload features or automated processing queues should still prioritize patching because repeated crashes can degrade service reliability and create operational noise.

How an attack unfolds

An attacker targets an application, API, batch-processing queue, or conversion service that uses a vulnerable ImageMagick release to process images. The attacker supplies an image or image-like file that drives ImageMagick into a path where FreeType initialization fails. Because the vulnerable code does not stop after that failure, it continues using memory that was already freed. If the heap state and runtime conditions align, this results in an invalid memory access and process crash. There is no public indication from the supplied data that reliable code execution exists, that exploit code is mature, or that the issue is being exploited in known campaigns; the main realistic outcome is denial of service against image-processing functionality.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-26 or later for the 7.x branch, or 6.9.13-51 or later for the 6.x branch. Where ImageMagick is delivered through an operating-system package manager, apply the vendor security update rather than relying only on upstream version strings, because distributions may backport fixes. If immediate upgrade is not possible, reduce exposure by restricting image upload and conversion endpoints, enforcing file size and type limits, isolating ImageMagick execution in a sandbox or container with resource limits, disabling unnecessary coders/delegates, and ensuring failed processing jobs do not repeatedly restart in a way that amplifies service disruption.

How to confirm the fix worked

Confirm installed ImageMagick versions with commands such as `magick -version`, `convert -version`, or package-manager inventory, and verify they report 7.1.2-26 or later, 6.9.13-51 or later, or a vendor-backported fixed build. Validate all runtime images, containers, serverless layers, build images, and bundled application dependencies, not just base operating-system packages. After patching, run representative image-processing workflows, including fonts/text-rendering paths that use FreeType, and confirm malformed inputs fail cleanly without crashing the worker process. For exposure validation, identify externally reachable upload, conversion, preview, thumbnailing, PDF/image, or media-processing features that invoke ImageMagick and confirm they are patched or isolated.

Typical attack path

1. Identify a publicly reachable application or service that accepts files and processes them with ImageMagick.
2. Submit crafted or malformed image content designed to trigger a FreeType initialization failure path.
3. Cause ImageMagick to continue execution after the failure and access freed memory.
4. Crash the ImageMagick process, worker, or dependent service handling the file.
5. Repeat submissions to cause recurring denial of service or processing backlog.

How to detect it

To determine whether exploitation was already attempted, review application logs, upload/API gateway logs, job queue logs, container orchestration events, system logs, and crash reporting for repeated failures during image conversion or thumbnail generation. Look for abnormal spikes in HTTP 4xx/5xx responses on image upload or conversion endpoints, repeated worker exits after processing specific uploaded files, segmentation faults or aborts from ImageMagick command-line tools or linked services, and core dumps generated during image-processing activity. On Linux, review journald, syslog, kernel logs, container logs, and service supervisor logs for `magick`, `convert`, `identify`, or application worker crashes. Correlate crashes with uploaded filenames, source IPs, request paths, and timestamps. Because no exploit-specific public artifact is provided, detection should focus on behavioral indicators: malformed image submissions followed by ImageMagick crashes, repeated retries of the same file, and denial-of-service patterns against media-processing workflows.

• magick: Segmentation fault
• convert: Segmentation fault
• identify: Segmentation fault
• Segmentation fault (core dumped)
• kernel: magick[
• kernel: convert[
• kernel: identify[
• dumped core
• core dumped
• ImageMagick
• MagickCore
• freetype
• FreeType
• /etc/ImageMagick-7/policy.xml
• /etc/ImageMagick-6/policy.xml
• /usr/bin/magick
• /usr/bin/convert
• /usr/bin/identify

What your security team should do

• Inventory ImageMagick usage across applications, containers, CI/CD images, media-processing services, and third-party packages.
• Prioritize upgrades on internet-facing upload or conversion services to ImageMagick 7.1.2-26 or later, 6.9.13-51 or later, or vendor-backported fixed packages.
• Apply compensating controls on exposed processing endpoints: authentication where feasible, strict file validation, size limits, rate limiting, queue limits, and sandboxed execution.
• Review ImageMagick security policy configuration to disable unneeded coders, delegates, and risky processing paths.
• Monitor for repeated ImageMagick crashes, worker restarts, failed conversion spikes, or upload attempts involving malformed image files.
• Treat this as a reliability and denial-of-service risk rather than a confirmed data-theft or ransomware vector based on the provided KEV, EPSS, and exploit-maturity data.