PT-2026-57444 · Imagemagick · Imagemagick

Rexpository · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-61857

NVD

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

CVE-2026-61857

Affected Products

Imagemagick

References · 3

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61857 · Security Note
• https://vulncheck.com/advisories/imagemagick-before-26-heap-use-after-free-via-xmp · Note