CVE-2026-56364 Details
Description
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
A memory leak vulnerability has been identified in ImageMagick versions prior to 7.1.2-13. The issue arises in the LoadOpenCLDeviceBenchmark() function within the MagickCore/opencl.c file. When the function processes malformed OpenCL device profile XML files that contain unclosed device elements, it fails to properly release memory allocated for several string attributes. This flaw can be exploited by attackers with write access to the OpenCL cache directory, allowing them to introduce malicious XML files that cause memory exhaustion and lead to a denial-of-service condition.
Users should update to ImageMagick version 7.1.2-13 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv | CISA-ADP | ExploitVendor Advisory |
| https://github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2e120f2fa26f | [email protected] | Patch |
| https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicebenchmark-via-malformed-xml | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| imagemagick imagemagick | < 7.1.2-13 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |