CVE-2026-56366CWE-401

ImageMagick - Memory Leak in META Reader APP1JPEG Error Path

Medium · published July 10, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00169 · 6.0th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-07-10T13:57Z
EPSS history
Timeline
  • 10 JUL 13:57Z
    ImageMagick - Memory Leak in META Reader APP1JPEG Error Path
    cvelistv5