Heap Buffer Overflow in ImageMagick magnify Operation

Executive Summary

CVE-2026-56372 is a heap buffer overflow vulnerability in ImageMagick versions prior to 7.1.2-19. It occurs during the magnify operation when an unrecognized "magnify:method" value is used, causing an out-of-bounds read of memory.

This means that the software reads memory outside the intended buffer, which can lead to unexpected behavior.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can potentially expose sensitive information by reading out-of-bounds memory or cause a denial of service by crashing the application.

It has a low severity rating and requires local access with low complexity to exploit. It does not impact confidentiality or integrity but may affect availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update ImageMagick to version 7.1.2-19 or later, where the heap buffer overflow issue in the magnify operation has been patched.

Avoid using unrecognized or unsupported magnify:method values in ImageMagick operations to prevent triggering the out-of-bounds read.

Useful 0 Not Useful 0