Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-56362: ImageMagick may read past memory, leading to crashes
CVE-2026-56362 · published 3 months ago
Summary
Versions of ImageMagick prior to 7.1.2-15 can read beyond allocated memory when processing images, which may cause the program to crash or behave unpredictably. This occurs when certain image data is handled incorrectly. Upgrade ImageMagick to the latest release to fix the issue.
What to do
- Update magick.net-q16-openmp-x86 to version 14.10.3.
- Update dirk lemstra magick.net-q8-anycpu to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-anycpu to version 14.10.3.
- Update dirk lemstra magick.net-q16-anycpu to version 14.10.3.
- Update dirk lemstra magick.net-q8-x86 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-openmp-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-openmp-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-openmp-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q8-openmp-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-x86 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-x86 to version 14.10.3.
- Update dirk lemstra magick.net-q8-arm64 to version 14.10.3.
- Update dirk lemstra magick.net-q8-openmp-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-x64 to version 14.10.3.
- Update dirk lemstra magick.net-q16-hdri-openmp-x64 to version 14.10.3.
- Update debian rootio-imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u11.root.io.35.
- Update debian imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u11.root.io.35.
- Update debian rootio-imagemagick to version 8:6.9.11.60+dfsg-1.3+deb11u4.root.io.31.
- Update debian rootio-imagemagick to version 8:6.9.11.60+dfsg-1.3+deb11u15.root.io.32.
- Update debian imagemagick to version 8:6.9.11.60+dfsg-1.6+deb12u11.aikido.54.
- Update debian rootio-imagemagick to version 8:6.9.11.60+dfsg-1.6+deb12u11.aikido.54.
- Update dirk lemstra magick.net-q8-x64 to version 14.10.3.
- Update debian imagemagick to version 8:6.9.11.60+dfsg-1.6+deb12u8.
- Update debian imagemagick to version 8:7.1.2.15+dfsg1-1.
- Update imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u11.aikido.39.
- Update rootio-imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u11.aikido.39.
- Update debian imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u12.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | – | magick.net-q16-openmp-x86 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-anycpu |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-anycpu |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-anycpu |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-x86 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-openmp-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-openmp-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-openmp-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-openmp-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-x86 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-x86 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-arm64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q8-openmp-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| nuget | dirk lemstra | magick.net-q16-hdri-openmp-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| – | imagemagick | imagemagick |
< 7.1.2-15 < 6.9.13-40 >= 7.0.0-0, < 7.1.2-15 |
| Ubuntu:Pro:26.04:LTS | canonical | imagemagick | All versions |
| Debian:11 | debian | imagemagick | All versions |
| Debian:12 | debian | imagemagick |
< 8:6.9.11.60+dfsg-1.6+deb12u8 Fix: upgrade to 8:6.9.11.60+dfsg-1.6+deb12u8
|
| Debian:13 | debian | imagemagick |
< 8:7.1.1.43+dfsg1-1+deb13u12 Fix: upgrade to 8:7.1.1.43+dfsg1-1+deb13u12
|
| Debian:14 | debian | imagemagick |
< 8:7.1.2.15+dfsg1-1 Fix: upgrade to 8:7.1.2.15+dfsg1-1
|
| Root:Debian:13 | debian | rootio-imagemagick |
< 8:7.1.1.43+dfsg1-1+deb13u11.root.io.35 Fix: upgrade to 8:7.1.1.43+dfsg1-1+deb13u11.root.io.35
|
| Ubuntu:Pro:14.04:LTS | canonical | imagemagick | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | imagemagick | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | imagemagick | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | imagemagick | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | imagemagick | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | imagemagick | All versions |
| Ubuntu:25.10 | canonical | imagemagick | All versions |
| Root:Debian:13 | debian | imagemagick |
< 8:7.1.1.43+dfsg1-1+deb13u11.root.io.35 Fix: upgrade to 8:7.1.1.43+dfsg1-1+deb13u11.root.io.35
|
| Root:Debian:11 | debian | rootio-imagemagick |
< 8:6.9.11.60+dfsg-1.3+deb11u4.root.io.31 < 8:6.9.11.60+dfsg-1.3+deb11u15.root.io.32 Fix: upgrade to 8:6.9.11.60+dfsg-1.3+deb11u4.root.io.31
|
| Root:Debian:12 | debian | imagemagick |
< 8:6.9.11.60+dfsg-1.6+deb12u11.aikido.54 Fix: upgrade to 8:6.9.11.60+dfsg-1.6+deb12u11.aikido.54
|
| Root:Debian:12 | debian | rootio-imagemagick |
< 8:6.9.11.60+dfsg-1.6+deb12u11.aikido.54 Fix: upgrade to 8:6.9.11.60+dfsg-1.6+deb12u11.aikido.54
|
| nuget | dirk lemstra | magick.net-q8-x64 |
< 14.10.3 Fix: upgrade to 14.10.3
|
| Root:Debian:13 | – | imagemagick |
< 8:7.1.1.43+dfsg1-1+deb13u11.aikido.39 Fix: upgrade to 8:7.1.1.43+dfsg1-1+deb13u11.aikido.39
|
| Root:Debian:13 | – | rootio-imagemagick |
< 8:7.1.1.43+dfsg1-1+deb13u11.aikido.39 Fix: upgrade to 8:7.1.1.43+dfsg1-1+deb13u11.aikido.39
|
Original advisory text
ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.
References
- https://security-tracker.debian.org/tracker/CVE-2026-56362 Vendor Advisory
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
- https://github.com/advisories/GHSA-gq5v-qf8q-fp77
- https://ubuntu.com/security/CVE-2026-56362 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-56362 Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp... Vendor Advisory
- https://www.vulncheck.com/advisories/imagemagick-heap-buffer-overflow-read-in-ge... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56362... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56362 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-122Heap-based Buffer Overflow
CWE-125Out-of-bounds Read
Timeline
Published8 Jul 2026
Updated30 Oct 2026
First seen6 Mar 2026
Sources
DEBIAN-CVE-2026-56362 · OSV
GHSA-gq5v-qf8q-fp77 · GHSA
CVE-2026-56362 · OSV
UBUNTU-CVE-2026-56362 · OSV
CVE-2026-56362 · MITRE
CVE-2026-56362 · NVD
Track software like this
Free during beta