CVE-2026-61872

What it actually does

ImageMagick versions before 7.1.2-26 and 6.9.13-51 can leak memory in the TIFF encoder when processing an invalid tiff:tile-geometry setting. The flaw does not provide code execution, data disclosure, or data modification, but repeated or long-running image conversion operations using malformed tile geometry can cause ImageMagick worker processes to consume increasing memory and potentially degrade availability or terminate under memory pressure.

Why it matters to the business

The likely consequence is localized service degradation in systems that rely on ImageMagick to generate or transform TIFF images, such as media processing pipelines, document conversion services, CMS platforms, and upload workflows. Because the issue requires specific TIFF encoder behavior and user-assisted or application-mediated processing, the overall risk is low, but exposed automated image-processing services could experience worker crashes, failed jobs, increased infrastructure costs, or temporary denial of service if malformed inputs are repeatedly processed.

How an attack unfolds

An attacker first identifies an application, script, or workflow that uses a vulnerable ImageMagick version to encode TIFF output with tile geometry options. The attacker then supplies an image-processing request, uploaded file, job definition, or command-line-equivalent parameter that causes ImageMagick to invoke the TIFF encoder with an invalid tiff:tile-geometry value. When the vulnerable encoder handles the malformed geometry, memory allocated during the operation is not released. A single attempt may have limited impact, but repeated processing or triggering the condition in long-running worker processes can steadily increase memory consumption until the process slows, is killed by the operating system, fails health checks, or causes queued image-processing jobs to fail.

How to fix it

Upgrade ImageMagick to a fixed release: ImageMagick 7.x should be upgraded to 7.1.2-26 or later, and ImageMagick 6.x should be upgraded to 6.9.13-51 or later. Where ImageMagick is bundled by an operating system distribution, container image, application package, or language wrapper, apply the vendor-provided patched package even if the displayed upstream version differs. If immediate upgrade is not possible, restrict or remove user control over ImageMagick encoder options, especially tiff:tile-geometry; validate tile geometry values against a strict allowlist; disable TIFF output where it is not required; run conversions in short-lived sandboxed workers; enforce memory, CPU, and execution-time limits; and isolate image-processing services from critical application components.

How to confirm the fix worked

Confirm the installed ImageMagick version with commands such as `magick -version`, `convert -version`, or package-manager inventory and verify it is 7.1.2-26 or later for the 7.x branch or 6.9.13-51 or later for the 6.x branch. Validate container images, CI build artifacts, server packages, and application dependencies that bundle ImageMagick or invoke it through wrappers. Review application configuration to confirm that untrusted users cannot directly set arbitrary ImageMagick `-define` options, especially `tiff:tile-geometry`. After patching, run representative TIFF conversion jobs under memory monitoring and confirm that malformed or rejected tile geometry inputs do not cause sustained memory growth, worker crashes, or OOM events.

Typical attack path

1. Find an application, service, batch job, or automation workflow that uses ImageMagick for TIFF encoding or conversion.
2. Determine whether the workflow accepts user-controlled image files, conversion options, job parameters, or profile settings that can influence TIFF tile geometry.
3. Submit a malformed tiff:tile-geometry value through the exposed workflow or cause a crafted conversion job to be executed.
4. Trigger vulnerable ImageMagick TIFF encoding on versions before 7.1.2-26 or 6.9.13-51.
5. Repeat the request or job to accumulate unreleased memory in worker processes.
6. Cause localized denial of service through process termination, job failures, degraded throughput, or host/container memory exhaustion.

How to detect it

To determine whether this condition was already triggered, review application, job-queue, web upload, and image-processing logs for failed or repeated TIFF conversion jobs involving `tiff:tile-geometry`, especially malformed values or unusual bursts from the same source. Inspect process accounting, EDR telemetry, container metrics, and operating-system logs for ImageMagick processes such as `magick`, `convert`, or `mogrify` showing steadily increasing memory usage, repeated restarts, termination by memory limits, or OOM killer events. Check web access logs and API request bodies where available for attempts to pass ImageMagick `-define` parameters or TIFF output options. In containerized environments, review Kubernetes events, container runtime logs, and orchestrator metrics for OOMKilled image-processing pods or workers correlated with TIFF conversion requests. Evidence is more likely to appear as availability degradation, failed jobs, and memory exhaustion than as persistent files or network callbacks, because the vulnerability is a denial-of-service memory leak rather than a code-execution issue.

• tiff:tile-geometry
• -define tiff:tile-geometry
• invalid tiff:tile-geometry
• magick
• convert
• mogrify
• OOMKilled
• Out of memory: Killed process
• Killed process convert
• Killed process magick
• Killed process mogrify
• memory cgroup out of memory
• TIFF encoder
• TIFFEncode
• tile-geometry

What your security team should do

• Inventory all systems, containers, build images, and applications that include or invoke ImageMagick, including indirect use through document, CMS, media, and thumbnailing components.
• Prioritize patching externally reachable or multi-tenant image-processing workflows, automated upload processors, and long-running worker pools that produce TIFF output.
• Upgrade to ImageMagick 7.1.2-26 or later, or 6.9.13-51 or later, using trusted upstream or operating-system vendor packages.
• Block or strictly validate user-controlled ImageMagick options and reject malformed `tiff:tile-geometry` values before invoking ImageMagick.
• Apply runtime containment for image conversion jobs, including memory limits, process timeouts, job quotas, worker recycling, and sandboxing.
• Search historical logs for malformed TIFF tile-geometry usage, repeated conversion failures, ImageMagick worker restarts, and operating-system OOM events around image-processing workloads.
• Because this is not in the CISA KEV catalog, has no known ransomware association, and has very low EPSS at publication time, handle it through normal patch cycles unless the affected service is internet-facing or business-critical.