UnratedFix available

DEBIAN-CVE-2026-61857

Type: advisorySource: OSV1 source record

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

Announced 11 Jul 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-61857

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-61857

imagemagick

Source reference: /affected/0/package/name

Affected versions: 8:6.9.11.60+dfsg-1.6
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u1
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u10
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u11
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u12
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u2
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u3
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u4
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u5
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u6
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u7
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u8
Source reference: /affected/0/versions
8:6.9.11.60+dfsg-1.6+deb12u9
Source reference: /affected/0/versions
Fixed versions: 8:6.9.11.60+dfsg-1.6+deb12u13
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

imagemagick

Source reference: /affected/1/package/name

Affected versions: 8:7.1.1.43+dfsg1-1
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u1
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u10
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u11
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u2
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u3
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u4
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u5
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u6
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u7
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u8
Source reference: /affected/1/versions
8:7.1.1.43+dfsg1-1+deb13u9
Source reference: /affected/1/versions
Fixed versions: 8:7.1.1.43+dfsg1-1+deb13u12
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

imagemagick

Source reference: /affected/2/package/name

Affected versions: 8:7.1.1.43+dfsg1-1
Source reference: /affected/2/versions
8:7.1.1.46+dfsg1-1
Source reference: /affected/2/versions
8:7.1.1.47+dfsg1-1
Source reference: /affected/2/versions
8:7.1.1.47+dfsg1-2
Source reference: /affected/2/versions
8:7.1.2.1+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.12+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.13+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.15+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.15+dfsg1-2
Source reference: /affected/2/versions
8:7.1.2.16+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.18+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.19+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.21+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.23+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.24+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.25+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.25+dfsg1-2
Source reference: /affected/2/versions
8:7.1.2.3+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.7+dfsg1-1
Source reference: /affected/2/versions
8:7.1.2.8+dfsg1-1
Source reference: /affected/2/versions
Fixed versions: 8:7.1.2.26+dfsg1-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "8:6.9.11.60+dfsg-1.6+deb12u13"
          }
        ]
      }
    ],
    "package": {
      "name": "imagemagick",
      "purl": "pkg:deb/debian/imagemagick?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "8:6.9.11.60+dfsg-1.6",
      "8:6.9.11.60+dfsg-1.6+deb12u1",
      "8:6.9.11.60+dfsg-1.6+deb12u10",
      "8:6.9.11.60+dfsg-1.6+deb12u11",
      "8:6.9.11.60+dfsg-1.6+deb12u12",
      "8:6.9.11.60+dfsg-1.6+deb12u2",
      "8:6.9.11.60+dfsg-1.6+deb12u3",
      "8:6.9.11.60+dfsg-1.6+deb12u4",
      "8:6.9.11.60+dfsg-1.6+deb12u5",
      "8:6.9.11.60+dfsg-1.6+deb12u6",
      "8:6.9.11.60+dfsg-1.6+deb12u7",
      "8:6.9.11.60+dfsg-1.6+deb12u8",
      "8:6.9.11.60+dfsg-1.6+deb12u9"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61857.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "8:7.1.1.43+dfsg1-1+deb13u12"
          }
        ]
      }
    ],
    "package": {
      "name": "imagemagick",
      "purl": "pkg:deb/debian/imagemagick?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "8:7.1.1.43+dfsg1-1",
      "8:7.1.1.43+dfsg1-1+deb13u1",
      "8:7.1.1.43+dfsg1-1+deb13u10",
      "8:7.1.1.43+dfsg1-1+deb13u11",
      "8:7.1.1.43+dfsg1-1+deb13u2",
      "8:7.1.1.43+dfsg1-1+deb13u3",
      "8:7.1.1.43+dfsg1-1+deb13u4",
      "8:7.1.1.43+dfsg1-1+deb13u5",
      "8:7.1.1.43+dfsg1-1+deb13u6",
      "8:7.1.1.43+dfsg1-1+deb13u7",
      "8:7.1.1.43+dfsg1-1+deb13u8",
      "8:7.1.1.43+dfsg1-1+deb13u9"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61857.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "8:7.1.2.26+dfsg1-1"
          }
        ]
      }
    ],
    "package": {
      "name": "imagemagick",
      "purl": "pkg:deb/debian/imagemagick?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "8:7.1.1.43+dfsg1-1",
      "8:7.1.1.46+dfsg1-1",
      "8:7.1.1.47+dfsg1-1",
      "8:7.1.1.47+dfsg1-2",
      "8:7.1.2.1+dfsg1-1",
      "8:7.1.2.12+dfsg1-1",
      "8:7.1.2.13+dfsg1-1",
      "8:7.1.2.15+dfsg1-1",
      "8:7.1.2.15+dfsg1-2",
      "8:7.1.2.16+dfsg1-1",
      "8:7.1.2.18+dfsg1-1",
      "8:7.1.2.19+dfsg1-1",
      "8:7.1.2.21+dfsg1-1",
      "8:7.1.2.23+dfsg1-1",
      "8:7.1.2.24+dfsg1-1",
      "8:7.1.2.25+dfsg1-1",
      "8:7.1.2.25+dfsg1-2",
      "8:7.1.2.3+dfsg1-1",
      "8:7.1.2.7+dfsg1-1",
      "8:7.1.2.8+dfsg1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61857.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #58087 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 17:37:10 GMT
Publisher date: Sat, 11 Jul 2026 14:16:23 GMT

Read the original announcement