CVE-2026-56364

Katalog CVE

CVSS 1.9 · Low EPSS 0,15%

Kerentanan Missing Release of Memory after Effective Lifetime pada imagemagick. Skor CVSS 3.1 1.9 (Low) menurut vulncheck.com.

Deskripsi (NVD)

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

Rincian

Terbit di NVD

30 Juni 2026

Terakhir diubah

2 Juli 2026

Status NVD

Analyzed

CVSS 3.1

1.9 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 4,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv exploit · advisory vendor
• https://github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2e120f2fa26f patch
• https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicebenchmark-via-malformed-xml patch · advisory pihak ketiga