CVE-2026-56365: ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-30 · updated 2026-10-29
Weakness: CWE-401

Description

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.

Affected products

ImageMagick: before 6.9.13-44; from 7.0.0-0 before 7.1.2-19 — fixed in 6.9.13-44, 7.1.2-19
ImageMagick: from 7.0.0 before 7.1.2-19 — fixed in 7.1.2-19

How to fix

Upgrade to a fixed version: ImageMagick 6.9.13-44, 7.1.2-19; ImageMagick 7.1.2-19. Check the vendor advisory for mitigations.

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x928-4434-crqj
https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-png-encoder-via-mng-image-writing

Get alerted when CVE-2026-56365 or the next vulnerability affects your stack