CVE-2026-56368
CVE-2026-56368 updated by NVD
Summary
ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| NuGet | Magick.NET-Q16-AnyCPU | — | 14.10.3 |
| NuGet | Magick.NET-Q16-arm64 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-AnyCPU | — | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-arm64 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-OpenMP-arm64 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-OpenMP-x64 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-x64 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-x86 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-OpenMP-arm64 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-OpenMP-x64 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-OpenMP-x86 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-x64 | — | 14.10.3 |
| NuGet | Magick.NET-Q16-x86 | — | 14.10.3 |
| NuGet | Magick.NET-Q8-AnyCPU | — | 14.10.3 |
| NuGet | Magick.NET-Q8-arm64 | — | 14.10.3 |
| NuGet | Magick.NET-Q8-OpenMP-arm64 | — | 14.10.3 |
| NuGet | Magick.NET-Q8-OpenMP-x64 | — | 14.10.3 |
| NuGet | Magick.NET-Q8-x64 | — | 14.10.3 |
| NuGet | Magick.NET-Q8-x86 | — | 14.10.3 |
Remediation: Upgrade to 14.10.3 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.