ImageMagick 7.1.2-26/6.9.13-51 UAF on Freetype init -> DoS
CVE-2026-61860 Published on July 15, 2026
ImageMagick before 7.1.2-26 Use-After-Free via freetype
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service.
Vulnerability Analysis
CVE-2026-61860 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-61860 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-61860
Want to know whenever a new CVE is published for ImageMagick? stack.watch will email you.
Affected Versions
ImageMagick:- Before 7.1.2-26 is affected.
- Version 7.1.2-26 is unaffected.
- Before 6.9.13-51 is affected.
- Version 6.9.13-51 is unaffected.