Skip to main content

ImageMagick CVE-2026-56366

| EUVDEUVD-2026-42888 MEDIUM
Memory Leak (CWE-401)
2026-07-10 VulnCheck GHSA-377p-xr9w-8773
Denial Of Service Red Hat Imagemagick Suse
4.8
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
4.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

File must be actively processed (UI:R); no privileges required to supply input; impact is availability-only and bounded (A:L), with no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat
3.3 LOW
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Patch available
Jul 10, 2026 - 16:16 EUVD
Analysis Generated
Jul 10, 2026 - 15:52 vuln.today

DescriptionCVE.org

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.

AnalysisAI

Memory leak in ImageMagick's META reader (versions before 7.1.2-18) enables denial of service through resource exhaustion when processing specially crafted APP1JPEG image files. The flaw sits in the error-handling path of the META reader, meaning memory allocated during malformed APP1JPEG processing is never freed, allowing an attacker to repeatedly trigger the leak until the host process exhausts available memory. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 4.8 (Medium) reflects limited impact scope.

Technical ContextAI

ImageMagick is an open-source image processing library and CLI toolset used extensively in web backends, CI pipelines, and content management systems. The META reader is the component responsible for parsing embedded metadata segments in image files, including APP1JPEG - a JPEG/JFIF application segment commonly carrying EXIF data. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): when the META reader encounters an error condition on an APP1JPEG input path, it exits without freeing previously allocated buffers. Because this is an error-path leak rather than a mainline-processing leak, normal well-formed image processing is unaffected, but malformed inputs reliably trigger unbounded memory growth per invocation. The affected CPE cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* covers all platform variants across every distribution prior to 7.1.2-18.

RemediationAI

Upgrade ImageMagick to version 7.1.2-18 or later, which resolves the memory management flaw in the META reader's APP1JPEG error path per vendor advisory GHSA-9r56-3gjq-hqf7 (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7). If immediate patching is not feasible for services that accept user-supplied images, restrict accepted input formats at the application layer by denying JPEG or files with embedded APP1 segments before they reach ImageMagick - this will break legitimate JPEG workflows but prevents triggering the vulnerable code path. Alternatively, enforce per-process memory ceilings via ulimit -v or cgroup memory limits on the ImageMagick worker processes; this does not eliminate the leak but bounds the blast radius by causing the process to fail fast rather than exhausting host memory. Sandbox isolation (e.g., running ImageMagick in a container with a memory cap) similarly contains impact. Rate-limiting file-processing endpoints reduces an attacker's ability to accumulate leaked memory rapidly.

More in Imagemagick

View all
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2016-3718 MEDIUM POC
5.5 May 05

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct

CVE-2016-3715 MEDIUM POC
5.5 May 05

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed

Share

CVE-2026-56366 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy