{"id":"CVE-2026-61872","aliases":[],"cve":{"records":[{"id":"CVE-2026-61872","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T21:54:26.760Z","published":"2026-07-15T11:25:55.435Z","modified":"2026-10-29T21:16:17.177Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-29T21:16:17.177Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-07-15T13:24:51.572Z"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h5r4-w88w-7ccr","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-via-tiff-encoder","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-401","description":"Missing Release of Memory after Effective Lifetime","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.2-26","versionStartIncluding":"7.0.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9.13-51"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-07-15T13:19:56.001975Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.","score":2.5,"severity":"low","published":"2026-07-15T11:25:55.435Z","modified":"2026-10-29T21:16:17.177Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"ImageMagick","name":"ImageMagick","platforms":[],"versions":[{"version":"7.0.0","status":"affected","lessThan":"7.1.2-26","versionType":"semver"},{"version":"7.1.2-26","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-61872"},{"vendor":"ImageMagick","name":"ImageMagick","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"6.9.13-51","versionType":"semver"},{"version":"6.9.13-51","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-61872"}],"remediation":[],"references":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h5r4-w88w-7ccr","https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-via-tiff-encoder"],"sources":[{"name":"CVE","id":"CVE-2026-61872","modified":"2026-10-29T21:16:17.177Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61872"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":2},{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","score":2.5}],"sourceAffected":[],"observedAt":"2026-10-29T21:29:45.840Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:20:32.820Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T23:15:31.272Z","attemptedAt":"2026-10-29T23:15:31.272Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T23:15:31.669Z","attemptedAt":"2026-10-29T23:15:31.669Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T23:15:31.404Z","attemptedAt":"2026-10-29T23:15:31.404Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T23:15:31.042Z","attemptedAt":"2026-10-29T23:15:31.042Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-61872","url":"https://www.first.org/epss/","probability":0.00096,"percentile":0.00678,"date":"2026-10-29","checkedAt":"2026-10-29T23:15:31.042Z"},{"source":"NVD","id":"CVE-2026-61872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61872","modified":"2026-10-29T21:17:29.167","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-29T23:15:31.272Z"},{"source":"NVD","id":"CVE-2026-61872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61872","modified":"2026-10-29T21:17:29.167","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","checkedAt":"2026-10-29T23:15:31.272Z"},{"source":"ENISA EUVD","id":"EUVD-2026-44620","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44620","modified":"Oct 29, 2026, 9:16:17 PM","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-10-29T23:15:31.404Z"},{"source":"GitHub Advisory Database","id":"GHSA-3mhh-97mg-5hxp","url":"https://github.com/advisories/GHSA-3mhh-97mg-5hxp","modified":"2026-07-15T12:32:14Z","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","checkedAt":"2026-10-29T23:15:31.669Z"}],"aiSummary":{"text":"ImageMagick before 7.1.2-26 and 6.9.13-51 has a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified, causing increased memory consumption. The weakness is due to missing release of memory after its effective lifetime. An attacker would need to supply malformed tile geometry parameters to exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:33:52.207Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-61872"}]}}