CVE-2026-61871

A flaw was found in ImageMagick. A remote attacker could exploit a memory leak in the ICON decoder by providing a specially crafted ICON file. When the file is processed, a memory allocation failure occurs, leading to memory exhaustion. This can result in a denial of service (DoS), making the affected system or application unavailable.

Red Hat Enterprise Linux ships ImageMagick in RHEL 6 ELS and RHEL 7 ELS. This flaw has been rated as having a Low security impact and is not currently planned to be addressed in future updates of those products. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process untrusted image files with ImageMagick. The ICON coder can be disabled in ImageMagick's policy.xml if not needed: <policy domain="coder" rights="none" pattern="ICON"/>. Upgrade to ImageMagick 7.1.2-26 or 6.9.13-51 mitigates the issue.