CVE-2026-61865

What it actually does

ImageMagick versions before 7.1.2-26 and 6.9.13-51 contain a memory leak in the Hough line detection operation. When a particular failure path is reached during image processing, a small amount of memory is not released. The issue does not provide code execution, data disclosure, or integrity impact, but repeated triggering can gradually increase process memory consumption and may contribute to local denial of service or job instability in systems that process many images.

Why it matters to the business

The likely consequence is degraded availability of image-processing workflows: worker processes may consume increasing memory, slow down, restart, or be killed by operating-system or container memory limits. Because the CVSS score is low, EPSS is very low, it is not in the CISA Known Exploited Vulnerabilities catalog, and no exploit maturity is reported, this should generally be treated as routine patching unless ImageMagick is exposed through high-volume automated image-processing services.

How an attack unfolds

An attacker needs a way to cause an affected ImageMagick installation to run the Hough lines operation on input that reaches the failing code path. In a local scenario, the attacker invokes ImageMagick directly with crafted parameters or input. In a service scenario, the attacker would need an application that accepts images or image-processing requests and exposes or internally uses the vulnerable Hough line operation. A single trigger leaks only a small amount of memory, so meaningful impact generally requires repeated submissions, batch processing, or a long-lived worker process where leaked memory accumulates over time until performance degrades or the process is terminated.

How to fix it

Upgrade ImageMagick to a fixed release: 7.1.2-26 or later for the 7.x branch, or 6.9.13-51 or later for the 6.x branch. If ImageMagick is provided by an operating-system distribution, install the vendor backported security update and verify the package changelog rather than relying only on upstream version strings. As temporary mitigations, disable or restrict workflows that invoke Hough line detection, enforce memory and CPU limits for ImageMagick processes, run image processing in isolated short-lived workers or containers, rate-limit untrusted image-processing requests, and reject unsupported or unexpected transformation parameters from users.

How to confirm the fix worked

Confirm the installed ImageMagick version with commands such as `magick -version`, `convert -version`, or the operating-system package manager. Validate that the effective version is 7.1.2-26 or later, 6.9.13-51 or later, or a vendor package that explicitly backports the fix. Review application dependency images and containers as well as host packages, because ImageMagick is frequently embedded in application runtimes. For operational validation, run representative Hough line processing workloads under memory monitoring and confirm memory is released after failures and that worker processes do not show repeated growth under test conditions.

Typical attack path

1. Identify a system, script, or application workflow that uses ImageMagick for Hough line detection or allows user-controlled ImageMagick transformations.
2. Confirm the target is running ImageMagick earlier than 7.1.2-26 in the 7.x branch or earlier than 6.9.13-51 in the 6.x branch.
3. Submit or process crafted input that causes the Hough lines operation to enter the failure path associated with the leak.
4. Repeat the operation many times or target long-running worker processes so leaked memory accumulates.
5. Cause image-processing jobs to slow, fail, restart, or be terminated by memory limits, producing a limited denial-of-service condition.

How to detect it

There are no reliable public exploitation indicators for this issue and no known KEV or ransomware association. To assess possible prior exploitation, review application, job queue, container, and operating-system logs for repeated ImageMagick executions involving Hough line processing, unexplained image-processing failures, worker restarts, and out-of-memory kills. Useful sources include web upload logs, API request logs for image transformation endpoints, background job logs, container runtime events, systemd journals, kernel OOM logs, and process telemetry from EDR or observability platforms. Look for repeated invocations of ImageMagick commands using Hough line options, abnormal memory growth in long-lived `magick` or `convert` processes, and bursts of failed image-processing jobs correlated with a single source user, IP address, or automation client. Treat such findings as suspicious only when they align with affected versions and repeated memory pressure, because the available details do not provide a unique exploit payload signature.

What your security team should do

• Inventory ImageMagick usage across servers, containers, build images, CI jobs, and application dependencies, prioritizing systems that process untrusted images or user-controlled transformations.
• Patch to ImageMagick 7.1.2-26 or later, 6.9.13-51 or later, or the applicable vendor-backported package.
• Prioritize internet-facing or multi-tenant image-processing services even though the vulnerability is low severity, because repeated requests can amplify availability impact.
• Apply runtime safeguards: memory limits, process timeouts, job queue rate limits, and isolation for ImageMagick workers.
• Disable or restrict Hough line operations where they are not required by business workflows.
• Monitor for unusual volumes of ImageMagick invocations, repeated Hough line processing failures, worker restarts, out-of-memory events, and rising resident memory in long-lived image-processing processes.