CVE-2026-56364

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56364

EUVD

EUVD-2026-40447

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 7.1.2-13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick versions before 7.1.2-13. It is a memory leak in the LoadOpenCLDeviceBenchmark() function that occurs when the software parses malformed OpenCL device profile XML files containing unclosed device elements.

Attackers who have write access to the OpenCL cache directory can exploit this by placing malicious XML files designed to exhaust memory, which can lead to a denial of service condition.

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS) attack. An attacker with write access to the OpenCL cache directory can cause the application to consume excessive memory by exploiting the memory leak, potentially causing the system or application to crash or become unresponsive.

Hi! I’m here to help you understand CVE-2026-56364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70