CVE-2026-56364CWE-401

ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML

Low · published June 30, 2026

CVSS v4.0
1.8
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

The record
Technical detail
CVSS v4.0
1.8 · LOW
Vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00154 · 4.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-06-30T22:08Z
EPSS history
Timeline
  • 30 JUN 22:08Z
    ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML
    cvelistv5