CVE-2026-56362
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In ImageMagick before version 7.1.2-15, there is a heap-buffer-overflow read vulnerability in the GetPixelIndex function. The issue arises because OpenPixelCache updates image channel metadata before allocating pixel cache memory. Attackers can trigger memory and disk allocation failures, causing a heap-buffer-overflow read that affects any writer calling GetPixelIndex.
Risk Assessment
The risk involves potential remote code execution or sensitive data disclosure via a specially crafted image. This vulnerability can be exploited in image processing services, compromising system confidentiality and integrity.
Recommendation
Immediately upgrade ImageMagick to version 7.1.2-15 or later. If an upgrade is not possible, temporarily restrict image processing to trusted sources only.
Original NVD description (English source)
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.