---
id: CVE-2026-61870
title: >-
  ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF
  encoder when memory allocation fails
summary: >-
  ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF
  encoder when memory allocation fails. Attackers can trigger allocation
  failures by processing specially crafted VIFF images to exhaust available
  memory and caus…
severity: low
cvss: 2.9
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-401
published: '2026-07-11'
updated: '2026-07-11'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61870'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-via-viff-encoder
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-07-12T00:16:39.381Z'
epss: 0.00191
epssPercentile: 0.08719
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick >= 7.0.0 < 7.1.2-26
  - ImageMagick < 6.9.13-51
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-13T16:09:14.622804Z'
---

## Overview

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.