by Kastro
Paper/Archive/CVE-2026-56372

CVE-2026-56372

ImageMagick ImageMagick — ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 26.2.262 × 205.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.

Affected

ProductAffectedFixed inSource
ImageMagick< 7.1.2-197.1.2-19CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
VulnCheck (CNA)4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
VulnCheck (CNA)3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorygithub.com/ImageMagick/ImageMagick/security/advisories/GHSA-8vfj-q2cp-5m5jwriteupvulncheck.com/advisories/imagemagick-heap-buffer-overflow-read-via-unrecognized-magnify-method