What’s Vulnerable › Vulnerabilities

CVE-2026-56364: ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML

• Severity: low (CVSS 1.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-30 · updated 2026-10-25
• Weakness: CWE-401

Description

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

Affected products

• ImageMagick: before 7.1.2-13 — fixed in 7.1.2-13

How to fix

Upgrade to a fixed version: ImageMagick 7.1.2-13. Check the vendor advisory for mitigations.

References

• https://github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2e120f2fa26f
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv
• https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicebenchmark-via-malformed-xml
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv

Get alerted when CVE-2026-56364 or the next vulnerability affects your stack