CVE-2026-61860

A flaw was found in ImageMagick. This vulnerability, a use-after-free, occurs when the freetype library fails to initialize, causing the software to continue processing with freed memory. A remote attacker could exploit this during image processing, leading to a denial of service (DoS) condition, which would make the service unavailable to legitimate users.

Red Hat Enterprise Linux ships ImageMagick in RHEL 6 ELS and RHEL 7 ELS. This flaw has been rated as having a Low security impact and is not currently planned to be addressed in future updates of those products. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process untrusted image files with ImageMagick. If font rendering via FreeType is not needed, the TTF and OTF coders can be disabled in ImageMagick's policy.xml: <policy domain="coder" rights="none" pattern="{TTF,OTF}"/>. Upgrade to ImageMagick 7.1.2-26 or 6.9.13-51 mitigates the issue.