Log in Start free

Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-56364ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML

Low 1.9

In plain English

A low-severity memory leak in ImageMagick from ImageMagick. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)1.9Low
Exploit odds (30 days)0.2%top 95.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13imagemagick8:7.1.1.43+dfsg1-1+deb13u11DEBIAN-CVE-2026-56364
Debian:14imagemagick8:7.1.2.13+dfsg1-1DEBIAN-CVE-2026-56364
NuGetmagick.net-q16-anycpu14.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-arm6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-hdri-anycpu14.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-hdri-arm6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-hdri-openmp-arm6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-hdri-openmp-x6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-hdri-x6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-hdri-x8614.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-openmp-arm6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-openmp-x6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-openmp-x8614.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-x6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q16-x8614.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q8-anycpu14.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q8-arm6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q8-openmp-arm6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q8-openmp-x6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q8-x6414.10.2GHSA-qp59-x883-77qv
NuGetmagick.net-q8-x8614.10.2GHSA-qp59-x883-77qv
Ubuntu:25.10imagemagickno fix listedUBUNTU-CVE-2026-56364

Affected products (as reported)

VendorProductVersions
ImageMagick ImageMagick 0 – before 7.1.2-13

Weakness: CWE-401 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

References