Junglewise Threat Intelligence

CVE-2026-56361: ImageMagick off-by-one error in morphology validation

CVE-2026-56361 · Severity: low · CVSS 3.3 · Published 2026-06-30

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), ImageMagick, Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: NuGet, ImageMagick.

Executive brief

ImageMagick, a widely used software suite for displaying and editing image files, is affected by a memory handling flaw. An attacker could exploit this by providing a specially crafted image or specific image processing parameters, potentially causing the application to crash. This could lead to a temporary disruption of services that rely on ImageMagick for automated image processing.

Technical details

An off-by-one error (CWE-193) exists in the morphology validation component of ImageMagick. The vulnerability is triggered when the software processes incorrect morphology parameters, leading to an out-of-bounds read (CWE-125) on the heap. Specifically, the flaw allows for a single-pixel memory access violation. While the impact is primarily limited to a denial-of-service (application crash), exploitation requires a local attacker to convince a user to process a malicious input (User Interaction Required). The issue is resolved in versions 7.1.2-19 and 6.9.13-44.

Affected products

  • ImageMagick ImageMagick < 7.1.2-19, < 6.9.13-44

Timeline

  • 2026-04-13: advisory: GitHub Security Advisory published
  • 2026-06-30: disclosed: NVD publication date

References

Related threats