Skip to main content

Unchecked Return Value

CVE-2026-61857

Medium
6.3/10

Summary

ImageMagick versions prior to 6.9.13-51 and 7.x prior to 7.1.2-26 and Magick.NET versions prior to 14.15.0 contain a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-252 - Unchecked Return Value

The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

References

Advisory Timeline

  • Published