Junglewise Threat Intelligence

CVE-2026-56373: ImageMagick use after free in PDB decoder

CVE-2026-56373 · Severity: low · CVSS 3.7 · Published 2026-07-10

Technologies: ImageMagick, Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet), Magick.NET-Q16-OpenMP-x86 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q16-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-x86 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: ImageMagick, NuGet.

Executive brief

ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its PDB (Palm Database) file decoder could allow a specially crafted file to cause the application to crash or behave unexpectedly. This could lead to a temporary service outage for applications that automatically process user-uploaded images.

Technical details

A use-after-free (UAF) vulnerability exists in the PDB decoder of ImageMagick. The flaw is triggered when a memory allocation fails, causing the decoder to utilize a stale pointer. An attacker can exploit this by providing a malicious PDB file for processing, which may result in a denial-of-service (crash) or a single zero-byte write to freed memory. The attack vector is network-based but requires high complexity to successfully trigger the specific memory failure condition. The issue is resolved in versions 7.1.2-15 and 6.9.13-40.

Affected products

  • ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40

Timeline

  • 2026-02-23: advisory: Initial GitHub Security Advisory published
  • 2026-07-10: disclosed: CVE published to NVD

References

Related threats