Information Disclosure in ImageMagick via Identify Command

Executive Summary

CVE-2026-61862 is an information disclosure vulnerability in ImageMagick versions before 7.1.2-26 and 6.9.13-51. When using the identify command with debug output enabled, a single byte beyond the profile boundary may be read and printed if the profile value is not printable. This occurs due to an out-of-bounds read and off-by-one error.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with local access to potentially read a small amount of unintended data from memory. However, it requires high attack complexity, does not grant privileges, and has no user interaction requirement. The impact is limited to low confidentiality leakage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability poses minimal compliance risk as it only allows limited information disclosure under specific conditions. It does not directly violate GDPR or HIPAA but could contribute to broader security concerns if exploited in a larger attack chain.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your ImageMagick version is prior to 7.1.2-26 or 6.9.13-51. Run the command: identify -version. If the output shows a version older than these, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-26 or later for the 7.x branch, or 6.9.13-51 or later for the 6.x branch. Disable debug output in the identify command if not required.

Useful 0 Not Useful 0