CVE-2026-56366
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
ImageMagick before version 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.
Risk Assessment
The risk involves the possibility of a remote DoS attack by delivering a malicious image file, potentially leading to unavailability of image processing services.
Recommendation
Immediately upgrade ImageMagick to version 7.1.2-18 or later, which includes a fix for the memory leak.
Original NVD description (English source)
ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.