CVE-2026-61857

Katalog CVE

CVSS 7.5 · High EPSS 0,27%

Kerentanan Unchecked Return Value pada imagemagick. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

Rincian

Terbit di NVD

11 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-252: Unchecked Return Value

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j advisory vendor
• https://www.vulncheck.com/advisories/imagemagick-before-26-heap-use-after-free-via-xmp broken link