| Name | CVE-2026-56366 |
| Description | ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-4680-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| imagemagick (PTS) | bookworm | 8:6.9.11.60+dfsg-1.6+deb12u11 | vulnerable |
| bookworm (security) | 8:6.9.11.60+dfsg-1.6+deb12u13 | fixed | |
| trixie | 8:7.1.1.43+dfsg1-1+deb13u12 | fixed | |
| trixie (security) | 8:7.1.1.43+dfsg1-1+deb13u11 | vulnerable | |
| forky | 8:7.1.2.29+dfsg2-1 | fixed | |
| sid | 8:7.1.2.31+dfsg1-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| imagemagick | source | bullseye | 8:6.9.11.60+dfsg-1.3+deb11u15 | DLA-4680-1 | ||
| imagemagick | source | bookworm | 8:6.9.11.60+dfsg-1.6+deb12u12 | DLA-4680-1 | ||
| imagemagick | source | trixie | 8:7.1.1.43+dfsg1-1+deb13u12 | |||
| imagemagick | source | (unstable) | 8:7.1.2.18+dfsg1-1 |
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/bee248ee853a686a969fae9cfb1e02dd5aae245b (7.1.2-18)
Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/1adc49fac3041620abe11fcb06524d33d9dbd035 (6.9.13-43)