Junglewise Threat Intelligence

CVE-2026-56376: ImageMagick heap use-after-free in meta coder

CVE-2026-56376 · Severity: low · CVSS 3.7 · Published 2026-06-23

Technologies: ImageMagick, Magick.NET-Q16-OpenMP-arm64 (NuGet), Magick.NET-Q16-AnyCPU (NuGet), Magick.NET-Q16-HDRI-AnyCPU (NuGet), Magick.NET-Q8-x86 (NuGet), Magick.NET-Q8-AnyCPU (NuGet), Magick.NET-Q16-arm64 (NuGet), Magick.NET-Q16-OpenMP-x64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet), Magick.NET-Q16-OpenMP-x86 (NuGet), Magick.NET-Q16-HDRI-arm64 (NuGet), Magick.NET-Q16-HDRI-x86 (NuGet), Magick.NET-Q16-HDRI-x64 (NuGet), Magick.NET-Q8-OpenMP-arm64 (NuGet), Magick.NET-Q8-OpenMP-x64 (NuGet), Magick.NET-Q8-arm64 (NuGet), Magick.NET-Q8-x64 (NuGet), Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet). Vendors: ImageMagick, NuGet.

Executive brief

ImageMagick is a widely used software suite for creating, editing, and converting digital images. A flaw in how it handles memory during image processing could allow an attacker to crash the application by providing a specially crafted image file. This could lead to a service outage for websites or applications that use ImageMagick to process user-uploaded content.

Technical details

A heap use-after-free vulnerability exists in ImageMagick's meta coder. The issue occurs when a memory allocation fails, leading to a single-byte write to a stale pointer. An attacker can exploit this by submitting a specially crafted image file for processing. While the attack complexity is high and the impact is limited to a denial of service (DoS) via application crash, it can be triggered remotely without user interaction. The vulnerability is addressed in versions 7.1.2-15 and 6.9.13-40.

Affected products

  • ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40

Timeline

  • 2026-02-23: advisory: Initial GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD

References

Related threats