CVE-2026-61862CWE-125

ImageMagick before 7.1.2-26 Information Disclosure via identify

Low · published July 15, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the profile boundary). This behavior occurs when debug output is enabled.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00105 · 1.0th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-07-15T11:25Z
EPSS history
Timeline
  • 15 JUL 11:25Z
    ImageMagick before 7.1.2-26 Information Disclosure via identify
    cvelistv5