CVE-2026-61863

What it actually does

The flaw is a small memory leak in ImageMagick's TIFF encoding path. When ImageMagick attempts to encode or write TIFF output and cannot create a required temporary file, allocated memory is not fully released. Repeated triggering of this error path can gradually increase memory consumption for the ImageMagick process or a long-running service that embeds or invokes ImageMagick. The impact is limited availability degradation rather than code execution, data theft, or data modification. The CVSS characteristics indicate local attack vector, high attack complexity, required attack conditions, no privileges required, no user interaction, and low availability impact.

Why it matters to the business

Systems that process images using affected ImageMagick versions may experience increased memory usage or service instability if the vulnerable TIFF encoding error path is triggered repeatedly. In most environments this is a low-severity operational risk, but it can still affect image-processing pipelines, upload workflows, document conversion services, media platforms, and batch jobs if resource limits are weak or ImageMagick runs inside long-lived worker processes. Exploitation is not known to be active, the EPSS score is very low, it is not in the CISA KEV catalog, and it is not known to be used in ransomware campaigns, so remediation should be handled through normal patch management unless the software is internet-adjacent or processes untrusted files at scale.

How an attack unfolds

An attacker must be able to cause an affected ImageMagick installation to perform TIFF encoding while the environment is unable to create a required temporary file. This may involve submitting image-conversion jobs to a local or application-exposed workflow and influencing conditions such as temporary-directory availability, permissions, quota exhaustion, disk-full states, or restrictive filesystem behavior. When the TIFF encoder hits the temporary-file creation failure path, a small memory allocation is leaked. A single attempt is unlikely to cause meaningful disruption, but repeated attempts against a long-running process can slowly consume memory and may eventually degrade performance, trigger worker restarts, or cause denial of service if memory limits are reached.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-26 or later for the 7.x branch, or 6.9.13-51 or later for the 6.x branch. If using operating-system packages, apply the vendor-provided security update for ImageMagick rather than relying only on upstream version strings, because distributions may backport the fix. Restart long-running services, workers, containers, or application processes that load or invoke ImageMagick after patching. As defense-in-depth, enforce memory limits for image-processing workers, run conversions in short-lived sandboxed processes where practical, ensure temporary directories have appropriate permissions and capacity monitoring, restrict supported output formats where TIFF output is not required, and rate-limit untrusted image-conversion requests.

How to confirm the fix worked

Confirm the installed ImageMagick version using commands such as `magick -version`, `convert -version`, or package-manager inventory, and verify it is 7.1.2-26 or later for ImageMagick 7.x or 6.9.13-51 or later for ImageMagick 6.x, or that the operating-system vendor advisory confirms a backported fix. Validate all runtime locations, containers, build images, application bundles, and statically packaged copies, not only the system package. After remediation, restart dependent services and confirm they are using the patched binary or library. For exposure validation, identify workflows that accept untrusted images and produce TIFF output, then review whether temporary-file failures can occur because of restrictive permissions, disk-full conditions, or quota limits. Monitor memory usage during TIFF conversion failure tests in a non-production environment to confirm the process no longer leaks memory on the temporary-file creation failure path.

Typical attack path

1. Identify an application, script, service, or batch workflow that uses ImageMagick to encode or convert images to TIFF.
2. Determine whether the ImageMagick version is older than 7.1.2-26 or, for the 6.x branch, older than 6.9.13-51.
3. Find a way to repeatedly trigger TIFF output processing using attacker-supplied or attacker-influenced image jobs.
4. Create or wait for conditions where ImageMagick cannot create a temporary file, such as exhausted temporary storage, quota exhaustion, permission denial, or restricted temporary-directory access.
5. Repeatedly submit conversion jobs that hit the TIFF encoder error path.
6. Rely on incremental memory leakage to degrade service performance, exhaust worker memory, or cause process/container restarts.

How to detect it

To determine whether this issue may have been exploited, review application, worker, container, and system logs for repeated ImageMagick TIFF conversion failures combined with temporary-file creation errors and rising memory usage. Relevant log sources include web application upload/conversion logs, job queue logs, ImageMagick wrapper logs, container runtime events, systemd journal entries, kernel out-of-memory logs, package inventory records, and monitoring telemetry for process RSS, container memory, disk usage, inode usage, and temporary-directory errors. Look for clusters of failed TIFF output jobs, repeated requests that request or generate `.tif` or `.tiff` outputs, errors referencing inability to create temporary files, and subsequent worker restarts or OOM kills. There are no public reports of active exploitation or named threat actors for this issue, so detection should focus on behavioral evidence rather than actor-specific infrastructure.

• unable to create temporary file
• unable to create temporary file in TIFF encoder
• No space left on device
• Permission denied
• Read-only file system
• Resource temporarily unavailable
• cache resources exhausted
• magick: unable to create temporary file
• convert: unable to create temporary file
• .tif
• .tiff
• OOMKilled
• Out of memory: Killed process
• Killed process
• memory cgroup out of memory
• systemd[1]: imagemagick
• magick
• convert

What your security team should do

• Patch affected ImageMagick installations during the next regular maintenance cycle, prioritizing internet-facing or multi-tenant image-processing services first.
• Inventory all ImageMagick binaries and libraries across hosts, containers, CI images, serverless packages, and application bundles, because applications may ship their own copy.
• Upgrade to ImageMagick 7.1.2-26 or later, or 6.9.13-51 or later, or install a vendor package containing the backported fix.
• Restart services and workers that invoke ImageMagick after patching to remove vulnerable code from memory and clear any leaked memory state.
• Apply resource controls such as memory limits, worker recycling, job timeouts, and request rate limits around image conversion services.
• Monitor temporary-directory health, disk capacity, inode usage, and permissions for image-processing workloads to reduce failure conditions that can trigger the vulnerable path.
• If TIFF output is not required, disable or restrict TIFF encoding in application workflows and policy configurations.
• Treat current urgency as low unless there is exposed untrusted image conversion at scale; the vulnerability has low EPSS, no known exploit maturity, and no KEV listing.