Low severity3.3NVD Advisory· Published Jun 30, 2026· Updated Jul 2, 2026
CVE-2026-56361
CVE-2026-56361
Description
ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.
Affected products
4cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*range: <6.9.13-44
- (no CPE)range: <7.1.2-19
- osv-coords2 versionspkg:rpm/opensuse/ImageMagick&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/ImageMagick&distro=openSUSE%20Tumbleweed
< 7.1.2.0-160000.11.1+ 1 more
- (no CPE)range: < 7.1.2.0-160000.11.1
- (no CPE)range: < 7.1.2.27-1.1
Patches
Vulnerability mechanics
References
2News mentions
2- ImageMagick: Fourteen Vulnerabilities Disclosed in Batch, Affecting Multiple VersionsVypr Intelligence · Jul 2, 2026
- ImageMagick: Six Vulnerabilities Disclosed, Including File Write and Info Disclosure FlawsVypr Intelligence · Jul 1, 2026