CVE-2026-56373
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
ImageMagick before version 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.
Risk Assessment
The risk includes potential application crashes when processing images and the possibility of writing to freed memory, which may lead to unpredictable behavior or further privilege escalation.
Recommendation
Immediately upgrade ImageMagick to version 7.1.2-15 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.