Junglewise Threat Intelligence

CVE-2026-56366: ImageMagick memory leak in META reader APP1JPEG path

CVE-2026-56366 · Severity: low · CVSS 3.3 · Published 2026-07-10

Technologies: ImageMagick, Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-OpenMP-x86 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: ImageMagick, NuGet.

Executive brief

ImageMagick, a widely used tool for displaying and converting images, contains a flaw in how it handles certain image metadata. An attacker could provide a specially crafted image file that, when processed, causes the software to consume excessive memory. This can lead to a system slowdown or a complete service outage (denial of service) as the computer runs out of available resources.

Technical details

A memory leak vulnerability (CWE-401) exists in ImageMagick's META reader component, specifically within the error handling path for APP1JPEG input. The issue is triggered when the application fails to release allocated memory after processing a malformed or specially crafted image file. An attacker can exploit this by inducing a user or automated system to process a malicious APP1JPEG file. Repeated exploitation can lead to resource exhaustion and a denial-of-service (DoS) condition. The vulnerability is addressed in versions 7.1.2-18 and 6.9.13-43.

Affected products

  • ImageMagick ImageMagick < 7.1.2-18, < 6.9.13-43

Timeline

  • 2026-03-24: advisory: GitHub Security Advisory published
  • 2026-07-10: disclosed: NVD publication date

References

Related threats