CVE-2026-56364

LOW 1.8 PoC AVAILABLE

Published 2026-06-30 · Last modified 2026-07-01

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

EXPLOIT AVAILABLE

Public exploit or PoC code exists. Modeled probability is still low, but the barrier to attack is reduced — watch closely.

Exploitation likelihood

0.1%chance of exploitation in 30 days · 2nd percentile

○ In CISA KEV ● Public exploit / PoC

Impact if exploited

1.8CVSS 4.0 · LOW

ConfidentialityNone
IntegrityNone
AvailabilityLow

What an attacker needs

⚠Access: Requires local access to the host
⚠Privileges: Requires an admin / high-privilege account
✓User interaction: No user interaction needed
⚠Complexity: Needs a race window or specific setup
⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

reference https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv
github-search Search GitHub for public PoC repos

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-56364/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-56364/poc.json

Affected

Vendors Imagemagick

Products Imagemagick

Weakness (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Known Affected Software Configurations

Vendor	Product	Version range
Imagemagick	Imagemagick	< 7.1.2-13

All CVSS metrics

LOW 1.8 v4.0 · CNA Primary
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
LOW 1.9 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
LOW 1.8 v4.0 · NVD Secondary
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
LOW 1.9 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

References

Exploits & PoC

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv vendor-advisoryexploitExploitVendor Advisory

Patches & mitigations

https://github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2e120f2fa26f patchPatch
https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicebenchmark-via-malformed-xml third-party-advisoryPatchThird Party Advisory

Sources: NVD · CVE.org · EPSS