CVE-2026-56366: ImageMagick Memory Leak DoS Vulnerability

CVE-2026-56366 Overview

CVE-2026-56366 is a memory leak vulnerability in ImageMagick versions before 7.1.2-18. The flaw resides in the META reader when processing APP1JPEG input paths. Attackers can trigger the leak by supplying specially crafted APP1JPEG image files, causing memory to accumulate without being freed. Repeated exploitation leads to resource exhaustion and denial of service on the host processing the images. The vulnerability is tracked under [CWE-401] (Missing Release of Memory after Effective Lifetime) and requires local access with user interaction. While the direct impact is limited to availability, environments that process untrusted images at scale face elevated risk.

Critical Impact
Repeated processing of malicious APP1JPEG files exhausts memory, degrading or crashing services that rely on ImageMagick for image conversion.

Affected Products

ImageMagick versions prior to 7.1.2-18
Applications embedding ImageMagick libraries (MagickCore, MagickWand)
Server-side image processing pipelines using ImageMagick as a backend

Discovery Timeline

2026-07-10 - CVE-2026-56366 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-56366

Vulnerability Analysis

The vulnerability is a memory leak in the META coder module of ImageMagick, which handles metadata-oriented image formats including APP1JPEG. When the META reader encounters an error path while processing an APP1JPEG input, allocated buffers are not released before the function returns. Each malformed input reprocessed by a long-running ImageMagick process contributes to steady heap growth. Over time this exhausts available memory and forces the operating system to terminate the process or trigger out-of-memory conditions across the host. The issue is classified under [CWE-401] and impacts availability only, with no compromise of confidentiality or integrity.

Root Cause

The root cause is missing cleanup logic in the META reader's error-handling branch for APP1JPEG decoding. When decoding fails, control returns to the caller without invoking the deallocation routines for the associated Image structure and pixel cache buffers. Additional technical detail is available in the VulnCheck Memory Leak Advisory.

Attack Vector

Exploitation requires an attacker to supply a crafted APP1JPEG file to a process that invokes ImageMagick locally. In server-side pipelines, attackers may reach the vulnerable code path by uploading crafted images through applications that hand off files to convert, identify, or the MagickCore library. Repeated submissions amplify the leak until the process or host runs out of memory. See the GitHub Security Advisory for details on the vulnerable code path.

// No verified proof-of-concept code is publicly available.
// Refer to the GitHub Security Advisory GHSA-9r56-3gjq-hqf7 for technical details.

Detection Methods for CVE-2026-56366

Indicators of Compromise

Steadily increasing resident memory (RSS) for processes such as convert, magick, or applications embedding MagickCore
Repeated failed decode entries for APP1JPEG inputs in ImageMagick or application logs
Out-of-memory (OOM) killer events targeting image processing workers
Unusually high volume of uploaded files with APP1JPEG metadata markers

Detection Strategies

Baseline memory consumption of ImageMagick worker processes and alert on sustained growth without corresponding workload increase
Inspect upload pipelines for repeated submissions of malformed JPEG files carrying APP1 segments
Correlate application error logs referencing META coder failures with host memory pressure events

Monitoring Recommendations

Enable process-level memory telemetry (cgroups, systemd accounting, or container metrics) for image processing services
Track OOM events in the kernel log (dmesg, journalctl -k) and forward to a central log store for correlation
Monitor request rates and file characteristics at the ingress layer for anomalous APP1JPEG submissions

How to Mitigate CVE-2026-56366

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-18 or later on all systems that process untrusted images
Inventory applications and containers that bundle ImageMagick and prioritize patching internet-facing services first
Apply resource limits (memory ceilings, process timeouts) to image processing workers to contain the impact of exploitation attempts

Patch Information

The fix is included in ImageMagick 7.1.2-18. Refer to the upstream GitHub Security Advisory GHSA-9r56-3gjq-hqf7 for patch details and consult your Linux distribution's package repository for backported updates.

Workarounds

Disable the APP1JPEG coder in policy.xml if the format is not required by your workflows
Restrict accepted image formats at the application layer using an allowlist of MIME types and magic-byte validation
Run ImageMagick in short-lived worker processes or containers with strict memory limits so leaked memory is reclaimed on restart

bash

# /etc/ImageMagick-7/policy.xml - disable the vulnerable coder
<policymap>
  <policy domain="coder" rights="none" pattern="APP1JPEG" />
  <policy domain="coder" rights="none" pattern="META" />
  <policy domain="resource" name="memory" value="256MiB" />
</policymap>