CVE-2026-56373
Received Received - Intake

Use-After-Free in ImageMagick PDB Decoder

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-56373
EUVD
EUVD-2026-42889

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-15 (exc)
imagemagick imagemagick to 6.9.13-40 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56373 is a use-after-free vulnerability in the PDB decoder of ImageMagick versions before 7.1.2-15 and 6.9.13-40.

This vulnerability occurs when memory allocation fails, causing the software to use a stale pointer, which is a pointer to memory that has already been freed.

Attackers can exploit this by processing specially crafted malicious PDB files, which can lead to application crashes or the ability to write a single zero byte to freed memory.

Impact Analysis

Exploitation of this vulnerability can cause the ImageMagick application to crash, potentially leading to denial of service.

Additionally, the vulnerability allows an attacker to write a single zero byte to freed memory, which could potentially be leveraged for further attacks, although the impact is considered low severity.

The vulnerability can be exploited remotely without requiring privileges or user interaction.

Mitigation Strategies

To mitigate this vulnerability, you should update ImageMagick to a fixed version. The vulnerability is patched in ImageMagick versions 7.1.2-15 and 6.9.13-40.

  • Upgrade ImageMagick to version 7.1.2-15 or later.
  • Alternatively, upgrade to version 6.9.13-40 or later if using the 6.x branch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart