CVE-2026-56376

ImageMagick - Heap Use-After-Free in Meta Coder

Published Jun 23, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.

Analysis

Technical impact

ImageMagick contains a heap use‑after‑free flaw in the meta coder. When a memory allocation fails, a single byte is written to a stale pointer, which can trigger a denial of service. The weakness is a classic use‑after‑free (CWE‑416) and also involves improper buffer direct access to heap memory (CWE‑825).

Affected Systems

The vulnerability affects all users of ImageMagick versions prior to 7.1.2‑15 and 6.9.13‑40. These versions are installed under the ImageMagick product from the ImageMagick vendor.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% combined with the absence of a CISA KEV listing indicates a very low likelihood of exploitation. Remote attackers can trigger the fault by providing a specially crafted image file; the exploit results in a denial of service, potentially impacting availability of any service that processes images using ImageMagick.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`7.0.0`	affected	< 7.1.2-15
`7.1.2-15`	unaffected	—

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 6.9.13-40
`6.9.13-40`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:imagemagick:imagemagick::::::::
	cpe:2.3:a:imagemagick:imagemagick::::::::

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[0,7.1.2-15)`	affected	semver	—
`7.1.2-15`	unaffected	semver	—
`[0,6.9.13-40)`	affected	semver	—
`6.9.13-40`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,7.1.2-15)`	affected	semver	—
`7.1.2-15`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,6.9.13-40)`	affected	semver	—
`6.9.13-40`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ImageMagick to version 7.1.2‑15 or later, or 6.9.13‑40 or later.
If an upgrade is not possible, isolate image processing in a sandboxed environment with limited privileges.
Implement input validation and buffer size checks to mitigate buffer direct access to heap memory that could trigger allocation failures.

Generated by OpenCVE AI on June 25, 2026 at 02:53 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4680-1	imagemagick security update
Debian DSA	DSA-6383-1	imagemagick security update
Github GHSA	GHSA-2gq3-ww97-wfjm	ImageMagick has a possible heap Use After Free vulnerability in its meta coder

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.320% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm
https://nvd.nist.gov/vuln/detail/CVE-2026-56376
https://www.cve.org/CVERecord?id=CVE-2026-56376
https://www.vulncheck.com/advisories/imagemagick-heap-use-after-free-in-meta-coder

History

Jun 25, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-56376 https://www.cve.org/CVERecord?id=CVE-2026-56376
Metrics	threat_severity `None`	threat_severity `Low`

Jun 23, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.
Title		ImageMagick - Heap Use-After-Free in Meta Coder
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-416
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm https://www.vulncheck.com/advisories/imagemagick-heap-use-after-free-in-meta-coder
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`