CVE-2026-56365 · Symaro Security Advisory

Description

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.

Severity (CVSS)

Base score	6.3
Severity	Medium
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-401 — Missing Release of Memory after Effective Lifetime

Affected products

Vendor	Product	Versions
ImageMagick	ImageMagick	0 to <7.1.2-19; 7.1.2-19
ImageMagick	ImageMagick	0 to <6.9.13-44; 6.9.13-44

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x928-4434-crqj (vendor-advisory)
https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-png-encoder-via-mng-image-writing (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 01 Jul 2026 07:05 UTC.