CVE-2026-56364

Low

Description

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

SeverityLow

CVSS1.9

Exploit probability—

ProductImagemagick

PublishedJun 30, 2026

First seenJun 30, 2026

Weakness typeCWE-401CWE-401

How to fix

Update

imagemagick imagemagick7.1.2-13 or later
Magick.NET-Q8-x6414.10.2 or later
Magick.NET-Q8-arm6414.10.2 or later
Magick.NET-Q8-x8614.10.2 or later
Magick.NET-Q8-OpenMP-x6414.10.2 or later
Magick.NET-Q8-OpenMP-arm6414.10.2 or later
Magick.NET-Q16-x6414.10.2 or later
Magick.NET-Q16-arm6414.10.2 or later
Magick.NET-Q16-x8614.10.2 or later
Magick.NET-Q16-OpenMP-x6414.10.2 or later
Magick.NET-Q16-OpenMP-arm6414.10.2 or later
Magick.NET-Q16-OpenMP-x8614.10.2 or later

Patches

github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2e120f2fa26f

Vendor advisories

github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv

Affected products

Product	Affected versions	Fixed in
imagemagick imagemagick	v < 7.1.2-13	7.1.2-13
Magick.NET-Q8-x64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q8-arm64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q8-x86NuGet	v < 14.10.2	14.10.2
Magick.NET-Q8-OpenMP-x64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q8-OpenMP-arm64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-x64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-arm64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-x86NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-x64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-arm64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-OpenMP-x86NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-HDRI-x64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-HDRI-arm64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-HDRI-x86NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-HDRI-OpenMP-x64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-HDRI-OpenMP-arm64NuGet	v < 14.10.2	14.10.2
Magick.NET-Q8-AnyCPUNuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-AnyCPUNuGet	v < 14.10.2	14.10.2
Magick.NET-Q16-HDRI-AnyCPUNuGet	v < 14.10.2	14.10.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.