CVE-2026-56366: imagemagick
CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-56366DEBIAN-CVE-2026-56366GHSA-9r56-3gjq-hqf7
Published 10-07-2026Last modified 14-07-2026
Vulnerability summary
CVE-2026-56366 is a medium (CVSS 6.5) vulnerability in imagemagick. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.9% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 9Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.
CVSS metrics
8 scores · 5 sources · 2 versionsMedium 4.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSources5 sources · 3.3–6.5
- CVE.orgCNA3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LDiffers
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
0.00 pp
From 0.17% on 20-09-2026
20-09-202620-10-2026
EPSS score0.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
NuGet18 products
- magick.net-q16-anycpu< 14.11.1
- Magick.NET-Q16-arm64< 14.11.1
- magick.net-q16-hdri-anycpu< 14.11.1
- Magick.NET-Q16-HDRI-arm64< 14.11.1
- Magick.NET-Q16-HDRI-OpenMP-arm64< 14.11.1
Debian1 product
- imagemagick< 8:6.9.11.60+dfsg-1.6+deb12u12 | < 8:7.1.1.43+dfsg1-1+deb13u12 | < 8:7.1.2.18+dfsg1-1
Imagemagick1 product
- imagemagick< 7.1.2-18 | < 6.9.13-43 | ≥ 7.0.0-0, < 7.1.2-18
Ubuntu1 product
- imagemagick< 8:6.7.7.10-6ubuntu3.13+esm25 | < 8:6.8.9.9-7ubuntu5.16+esm24 | < 8:6.9.7.4+dfsg-16ubuntu6.15+esm16 | < 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm14 | < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm14 | < 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm13
4 vendors · 21 products
References
8 links- www.vulncheck.com/advisories/imagemagick-memory-leak-in-meta-reader-app1jpeg-error-pathThird Party AdvisoryREPORT
