ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. (CVE-2026-61868)

CVE-2026-61868 describes a memory leak in the YUV decoder component of ImageMagick that occurs when the opening of the blob fails. This flaw affects ImageMagick versions prior to 7.1.2-26 and 6.9.x versions prior to 6.9.13-51. Repeated triggering of this failure condition can cause resource exhaustion, resulting in a denial of service condition. The vulnerability is rated medium severity with a CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). The extensive list of affected versions includes many Ubuntu package releases before the fixed versions.

The vulnerability causes a memory leak that can lead to resource exhaustion if exploited repeatedly, resulting in denial of service. There is no impact on confidentiality or integrity. No known active exploitation has been reported.

A fix is available in ImageMagick versions 7.1.2-26 and 6.9.13-51 and later. Users should upgrade to these or later versions to remediate the memory leak vulnerability. Since this is a resource exhaustion issue, patching is the recommended mitigation. No additional vendor advisory details were provided, so check the vendor advisory for the latest remediation guidance.