CVE-2026-61871

What it actually does

The vulnerability is a memory leak in the ICON image decoder that triggers when a memory allocation fails during processing of a specially crafted ICON file, gradually exhausting available memory and causing denial of service.

Why it matters to the business

Attackers can cause image processing services to become unavailable by submitting malicious image files, leading to operational disruptions without data compromise.

How an attack unfolds

An attacker crafts an ICON file designed to cause a memory allocation failure in the decoder, then submits it to an ImageMagick-based application for processing, resulting in repeated memory leaks that degrade system performance over time.

How to fix it

Upgrade ImageMagick to version 7.1.2-26 or later, or 6.9.13-51 or later.

How to confirm the fix worked

Verify the installed ImageMagick version is at or above the fixed releases and test processing of sample ICON files for memory stability.

Typical attack path

1. Identify an application using vulnerable ImageMagick for image processing
2. Craft a malicious ICON file to trigger allocation failure
3. Submit the file via network or upload interface
4. Repeat submissions to exhaust memory and cause DoS

How to detect it

Monitor system logs for repeated image processing failures or abnormal memory consumption spikes associated with ICON file handling; no specific post-exploitation artifacts are typically left.

What your security team should do

• Prioritize updating ImageMagick installations to the patched versions
• Review and restrict image processing to trusted sources if possible
• Monitor for unusual memory usage patterns in image handling services