CVE-2026-61465
Received Received - Intake

Memory Exhaustion in ImageMagick via Canny Filter

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-61465
EUVD
EUVD-2026-43185

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-26 (exc)
imagemagick imagemagick to 6.9.13-51 (exc)
imagemagick imagemagick to 7.1.2-26|end_excluding=6.9.13-51 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in ImageMagick versions before 7.1.2-26 and 6.9.13-51. It occurs because certain matrix-backed operations, such as the -canny command, do not properly check the allowed memory allocation limits.

An attacker can supply a specially crafted image that causes ImageMagick to allocate more memory than the configured policy permits.

This results in a denial of service due to excessive memory consumption.

Impact Analysis

The primary impact of this vulnerability is a denial of service condition caused by uncontrolled memory allocation.

An attacker with local access can trigger this by providing a crafted image, leading to reduced availability of the ImageMagick component.

This can disrupt services or applications that rely on ImageMagick for image processing.

Detection Guidance

This vulnerability involves ImageMagick versions prior to 7.1.2-26 and 6.9.13-51 and specifically affects matrix-backed operations such as the -canny command. Detection involves verifying the installed ImageMagick version to see if it is vulnerable.

  • Check the ImageMagick version installed on your system using the command: `magick -version` or `convert -version`.
  • Attempt to identify usage of matrix-based operations like `-canny` in image processing scripts or commands.
  • Monitor for unusual memory allocation or crashes related to ImageMagick processes, which may indicate exploitation attempts.
Mitigation Strategies

To mitigate this vulnerability, the primary step is to upgrade ImageMagick to a fixed version that includes the necessary memory allocation checks.

  • Upgrade ImageMagick to version 7.1.2-26 or later, or 6.9.13-51 or later.
  • Avoid processing untrusted images with matrix-backed operations such as `-canny` until the upgrade is applied.
  • Implement resource usage monitoring and limits on ImageMagick processes to detect and prevent excessive memory consumption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61465. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart