CVE-2026-61866

A flaw was found in ImageMagick. A memory leak vulnerability exists in the JNG (JPEG Network Graphics) encoder when the application fails to open a blob. A remote attacker could exploit this by providing specially crafted malformed JNG files, leading to resource exhaustion and a denial of service (DoS) for the affected system.

Red Hat Enterprise Linux ships ImageMagick in RHEL 6 ELS and RHEL 7 ELS. This flaw has been rated as having a Low security impact and is not currently planned to be addressed in future updates of those products. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process untrusted image files with ImageMagick. The JNG coder can be disabled in ImageMagick's policy.xml if not needed: <policy domain="coder" rights="none" pattern="JNG"/>. Upgrade to ImageMagick 7.1.2-26 or 6.9.13-51 mitigates the issue.