Vulnerability Description
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Imagemagick | Imagemagick | < 7.1.2-13 |
Related Weaknesses (CWE)
References
- https://github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2ePatch
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77ExploitVendor Advisory
- https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicePatchThird Party Advisory
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77ExploitVendor Advisory
FAQ
What is CVE-2026-56364?
CVE-2026-56364 is a vulnerability with a CVSS score of 1.9 (LOW). ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers...
How severe is CVE-2026-56364?
CVE-2026-56364 has been rated LOW with a CVSS base score of 1.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56364?
Check the references section above for vendor advisories and patch information. Affected products include: Imagemagick Imagemagick.