CVE-2026-61862: ImageMagick before 7.1.2-26 Information Disclosure via identify
ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the profile boundary). This behavior occurs when debug output is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-26 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-51 - Configuration
Ensure debug output is disabled so that the vulnerable behavior (printing a byte beyond the profile boundary) does not occur when using the identify command.
ImageMagick identify command debug output = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61862?
The severity of CVE-2026-61862 is rated as low with a score of 2.1.
How do I fix CVE-2026-61862?
To fix CVE-2026-61862, update ImageMagick to version 7.1.2-26 or later.
What type of vulnerability is CVE-2026-61862?
CVE-2026-61862 is an information disclosure vulnerability.
Which versions of ImageMagick are affected by CVE-2026-61862?
CVE-2026-61862 affects ImageMagick versions before 7.1.2-26 and 6.9.13-51.
What is the impact of CVE-2026-61862?
The impact of CVE-2026-61862 is the potential leakage of a single byte past the profile boundary when using the identify command.