CVE-2026-56368: ImageMagick Memory Leak DoS Vulnerability

CVE-2026-56368 Overview

CVE-2026-56368 is a memory leak vulnerability in ImageMagick versions before 7.1.2-15. The flaw resides in multiple coders that write raw pixel data, where allocated objects are not properly freed during image processing operations. Attackers can trigger the leak by submitting specially crafted images, gradually exhausting available memory on the host system.

The vulnerability is classified under CWE-401: Missing Release of Memory after Effective Lifetime. Successful exploitation results in denial of service through memory exhaustion, particularly impacting servers that process untrusted image uploads at scale.

Critical Impact
Repeated processing of crafted images causes memory exhaustion, leading to denial of service in image conversion pipelines, web services, and batch processing workloads relying on ImageMagick.

Affected Products

ImageMagick versions prior to 7.1.2-15
Applications and services embedding vulnerable ImageMagick libraries
Web platforms using ImageMagick for user-supplied image processing

Discovery Timeline

2026-06-24 - CVE-2026-56368 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56368

Vulnerability Analysis

The vulnerability affects multiple coders within ImageMagick responsible for writing raw pixel data. During image encoding, the affected coders allocate memory for intermediate pixel structures and auxiliary objects. The execution paths fail to release these allocations on certain code branches, leaving orphaned memory on the heap after each processing cycle.

An attacker who can submit images to a service using ImageMagick triggers repeated allocations without corresponding deallocations. Over time, resident memory grows until the process is terminated by the operating system or becomes unresponsive. The condition affects long-running services that process many images per session, such as upload handlers, thumbnail generators, and document conversion services.

The attack vector is network-based and requires no authentication or user interaction. However, the attack complexity is elevated because exploitation depends on specific image formats and repeated requests to produce meaningful resource exhaustion.

Root Cause

The root cause is improper memory lifecycle management [CWE-401] in raw pixel data coders. Allocated objects, including pixel buffers and metadata structures, are not freed along all error and success paths. The defect resides in the encoding routines rather than the decoder, distinguishing it from prior ImageMagick parsing vulnerabilities.

Attack Vector

Exploitation requires the attacker to submit crafted images to an endpoint that invokes a vulnerable ImageMagick coder for writing raw pixel data. Image conversion services, content management systems, and API endpoints accepting image uploads are the primary attack surfaces. Sustained submission of malicious payloads incrementally consumes server memory until denial of service occurs.

The vulnerability mechanism is described in the ImageMagick GitHub Security Advisory GHSA-wfx3-6g53-9fgc and the VulnCheck Advisory on Memory Leak.

Detection Methods for CVE-2026-56368

Indicators of Compromise

Steady growth in resident set size (RSS) of ImageMagick worker processes without corresponding workload increase
Repeated OutOfMemory events or process restarts in image conversion services
Unusual volume of image conversion requests originating from a small set of source IP addresses
Worker processes terminated by the kernel out-of-memory (OOM) killer during image processing

Detection Strategies

Inventory all systems running ImageMagick and confirm version against 7.1.2-15 to identify exposure
Monitor convert, magick, and library-linked processes for unbounded heap growth using process memory metrics
Inspect web application logs for repeated image upload requests with anomalous file structures or sizes
Correlate application restarts with image processing activity to identify resource exhaustion patterns

Monitoring Recommendations

Enable per-process memory limits via cgroups or container runtime to expose abnormal memory consumption
Track ImageMagick resource limits configured in policy.xml, including memory and map ceilings
Alert on sustained memory growth exceeding baseline thresholds in image processing service tiers
Log image format, dimensions, and processing duration to identify malicious submission patterns

How to Mitigate CVE-2026-56368

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-15 or later across all systems processing untrusted images
Audit downstream applications and language bindings that embed ImageMagick to confirm patched library versions
Restrict image processing services to authenticated users where business requirements permit
Apply rate limiting on image upload and conversion endpoints to slow exploitation attempts

Patch Information

The vulnerability is resolved in ImageMagick 7.1.2-15. Refer to the ImageMagick GitHub Security Advisory GHSA-wfx3-6g53-9fgc for patch commits and release notes. Operators using distribution packages should track vendor backports and update once fixes are published.

Workarounds

Configure strict resource limits in ImageMagick policy.xml, including memory, map, area, and disk ceilings
Isolate image processing in short-lived worker processes or containers that are recycled after a fixed number of requests
Restrict accepted image formats to a minimal allowlist required by the application
Deploy a reverse proxy or web application firewall rule to limit image size and submission rate per client

bash

# Example ImageMagick policy.xml resource constraints
# Location: /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
  <policy domain="resource" name="area" value="128MB"/>
  <policy domain="resource" name="disk" value="1GiB"/>
  <policy domain="resource" name="time" value="30"/>
</policymap>