critical
CVE-2026-56372
ImageMagick: ImageMagick: Information Disclosure and Denial of Service
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat6.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Julia4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Julia (medium), Ubuntu (medium).
Description
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | imagemagick-6 | 0 |
| debian 13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u12 |
| debian 14 | imagemagick | 8:7.1.2.19+dfsg1-1 |
| echo | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u11+e2 |
| julia::Julia Ecosystem Security Advisories | ImageMagick_jll | 7.1.2023+0 |
| minimos | imagemagick | 7.1.2.0-r0 |
| rapidfort alpine 3.20 | imagemagick | 7.1.2.0-r0 |
| rapidfort alpine 3.21 | imagemagick | 7.1.2.0-r0 |
| rapidfort alpine 3.24 | imagemagick | 7.1.2.0-r0 |
| rapidfort debian 12 | imagemagick, rf-imagemagick | 8:7.1.1.43+dfsg1-1+deb13u12, 8:7.1.2.19+dfsg1-1 |
| rapidfort debian 13 | imagemagick, rf-imagemagick | 8:7.1.1.43+dfsg1-1+deb13u12, 8:7.1.2.19+dfsg1-1 |
| rapidfort ubuntu 20.04 | imagemagick, rf-imagemagick | 8:7.1.2.19+dfsg1-1 |
Show all 28 entries from 17 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | imagemagick-6 | 0 |
| debian 13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u12 |
| debian 14 | imagemagick | 8:7.1.2.19+dfsg1-1 |
| echo | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u11+e2 |
| julia::Julia Ecosystem Security Advisories | ImageMagick_jll | 7.1.2023+0 |
| minimos | imagemagick | 7.1.2.0-r0 |
| rapidfort alpine 3.20 | imagemagick | 7.1.2.0-r0 |
| rapidfort alpine 3.21 | imagemagick | 7.1.2.0-r0 |
| rapidfort alpine 3.24 | imagemagick | 7.1.2.0-r0 |
| rapidfort debian 12 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u12, 8:7.1.2.19+dfsg1-1 |
| rapidfort debian 12 | rf-imagemagick | 8:7.1.1.43+dfsg1-1+deb13u12, 8:7.1.2.19+dfsg1-1 |
| rapidfort debian 13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u12, 8:7.1.2.19+dfsg1-1 |
| rapidfort debian 13 | rf-imagemagick | 8:7.1.1.43+dfsg1-1+deb13u12, 8:7.1.2.19+dfsg1-1 |
| rapidfort ubuntu 20.04 | imagemagick | 8:7.1.2.19+dfsg1-1 |
| rapidfort ubuntu 20.04 | rf-imagemagick | 8:7.1.2.19+dfsg1-1 |
| rapidfort ubuntu 22.04 | imagemagick | 8:7.1.2.19+dfsg1-1 |
| rapidfort ubuntu 22.04 | rf-imagemagick | 8:7.1.2.19+dfsg1-1 |
| rapidfort ubuntu 24.04 | imagemagick | 8:7.1.2.19+dfsg1-1 |
| rapidfort ubuntu 24.04 | rf-imagemagick | 8:7.1.2.19+dfsg1-1 |
| Red Hat | ImageMagick | no fix listed |
| Red Hat | ImageMagick-c++ | no fix listed |
| Red Hat | ImageMagick-c++-devel | no fix listed |
| Red Hat | ImageMagick-devel | no fix listed |
| Red Hat | ImageMagick-doc | no fix listed |
| Red Hat | ImageMagick-perl | no fix listed |
| seal Red Hat 7 | imagemagick | 6.9.10.68-6.el7_9+sp999 |
| seal Red Hat 7 | seal-imagemagick | 6.9.10.68-6.el7_9+sp999 |
| ubuntu 26.04 | imagemagick | no fix listed |
References
- https://access.redhat.com/security/cve/CVE-2026-56372
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8vfj-q2cp-5m5j
- https://github.com/advisories/GHSA-x98x-mp75-v6m4
- https://nvd.nist.gov/vuln/detail/CVE-2026-56372
- https://www.cve.org/CVERecord?id=CVE-2026-56372
- https://www.vulncheck.com/advisories/imagemagick-heap-buffer-overflow-read-via-unrecognized-magnify-method