CVE-2026-56368

LowCVSS 3.7

Published: 24/06/2026(UTC)Updated: 29/10/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

40th percentile - higher than 40% of all known CVEs

Summary

A memory leak vulnerability in ImageMagick before version 7.1.2-15 exists in multiple coders that write raw pixel data, where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, leading to memory exhaustion and denial of service.

Risk Assessment

The risk involves a potential DoS (denial of service) attack by sending a malicious image, which can exhaust system memory and disrupt applications using ImageMagick.

Recommendation

It is recommended to immediately upgrade ImageMagick to version 7.1.2-15 or later, which includes a fix for the memory leak.

Other vulnerabilities in ImageMagick przed wersją 7.1.2-15

CVE-2026-56370Low
A vulnerability in ImageMagick before version 7.1.2-19 allows out-of-bounds access in the ConnectedComponentsImage() function when processing connected-components artifacts with invalid indices. Attackers can trigger access violations via CLI, leading to denial of service or potential code execution.

Original NVD description (English source)

ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS