Junglewise Threat Intelligence

CVE-2026-56363: ImageMagick division by zero in binomial kernel processing

CVE-2026-56363 · Severity: low · CVSS 3.3 · Published 2026-06-30

Technologies: Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), ImageMagick, Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: NuGet, ImageMagick.

Executive brief

ImageMagick is a widely used software suite for editing and processing digital images. A vulnerability in how it handles specific mathematical image filters (binomial kernels) could allow an attacker to crash the application by providing a specially crafted image or command. This results in a denial-of-service, potentially disrupting automated image processing workflows or applications that rely on ImageMagick.

Technical details

A division by zero vulnerability exists in ImageMagick's binomial kernel processing logic. The flaw is rooted in an integer overflow (CWE-190) that occurs when a user supplies an excessively large binomial kernel value. This overflow results in a zero value being used in a subsequent division operation (CWE-369), leading to an application crash. Exploitation requires local access and user interaction, such as a user being tricked into processing a malicious file. The issue is resolved in versions 7.1.2-22 and 6.9.13-47.

Affected products

  • ImageMagick ImageMagick < 7.1.2-22, < 6.9.13-47

Timeline

  • 2026-05-16: advisory: GitHub Security Advisory published
  • 2026-06-30: disclosed: NVD publication date

References

Related threats