CVE-2026-56364: imagemagick
CVSS: 1.9v3.1LowAnalyzed
AliasesUBUNTU-CVE-2026-56364DEBIAN-CVE-2026-56364CGA-37jg-96cm-3q6wGHSA-qp59-x883-77qvCGA-q7ch-cr3r-w7xc
Published 30-06-2026Last modified 01-07-2026
Vulnerability summary
CVE-2026-56364 is a low (CVSS 1.9) vulnerability in imagemagick. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
1.9/10
010
Low · v3.1 (CVE.org)EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 6 · Related 7Timeline
- 30-06-2026PublishedVulnerability first disclosed.
- 01-07-2026Last modifiedVulnerability information updated.
Description
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
CVSS metrics
9 scores · 6 sources · 2 versionsLow 1.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated1.8LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated1.8LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated1.8LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST1.8LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low 1.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:LSources4 sources · 1.9–6.5
- OSV · UbuntuEcosystem advisory · calculated1.9LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
- OSV · NugetEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:HDiffers
- NVDNIST1.9LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.15%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
0.00 pp
From 0.15% on 21-09-2026
21-09-202621-10-2026
EPSS score0.15%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundImagemagick
Maturity: poc
Weaknesses
CWE · root causeAffected systems
NuGet19 products
- magick.net-q16-anycpu< 14.10.2
- Magick.NET-Q16-arm64< 14.10.2
- magick.net-q16-hdri-anycpu< 14.10.2
- Magick.NET-Q16-HDRI-arm64< 14.10.2
- Magick.NET-Q16-HDRI-OpenMP-arm64< 14.10.2
Chainguard1 product
- imagemagick-6All versions (No fix recorded)
Debian1 product
- imagemagick< 8:7.1.1.43+dfsg1-1+deb13u11 | < 8:7.1.2.13+dfsg1-1
Imagemagick1 product
- imagemagick< 7.1.2-13
Ubuntu1 product
- imagemagickAll versions (No fix recorded)
5 vendors · 23 products
References
10 links- github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qvVendor AdvisoryREPORTAdvisoryWEBExploit
- www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicebenchmark-via-malformed-xmlThird Party AdvisoryREPORTAdvisoryPatch
