LowFix available
imagemagick — security advisory
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
- Products
- imagemagick
- Affected versions
- 8:7.1.1.43+dfsg1-1, 8:7.1.1.43+dfsg1-1+deb13u1, 8:7.1.1.43+dfsg1-1+deb13u10, 8:7.1.1.43+dfsg1-1+deb13u2, 8:7.1.1.43+dfsg1-1+deb13u3, 8:7.1.1.43+dfsg1-1+deb13u4, 8:7.1.1.43+dfsg1-1+deb13u5, 8:7.1.1.43+dfsg1-1+deb13u6, 8:7.1.1.43+dfsg1-1+deb13u7, 8:7.1.1.43+dfsg1-1+deb13u8, 8:7.1.1.43+dfsg1-1+deb13u9, 8:7.1.1.46+dfsg1-1, 8:7.1.1.47+dfsg1-1, 8:7.1.1.47+dfsg1-2, 8:7.1.2.1+dfsg1-1, 8:7.1.2.12+dfsg1-1, 8:7.1.2.3+dfsg1-1, 8:7.1.2.7+dfsg1-1, 8:7.1.2.8+dfsg1-1
- Fixed versions
- 8:7.1.1.43+dfsg1-1+deb13u11, 8:7.1.2.13+dfsg1-1
- CVEs
- CVE-2026-56364
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 12:17 UTC · Revision 2
Source evidence
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.
osv:DEBIAN-CVE-2026-56364
imagemagick
Fixed versions: 8:7.1.1.43+dfsg1-1+deb13u11
imagemagick
Fixed versions: 8:7.1.2.13+dfsg1-1
Complete source record
{
"id": "d2cfb8cb4c9859769a04899778c8858e365f22eb077aa3bd1cb231667f2a7c06",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-56364",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-56364",
"summary": "ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.",
"evidence": "osv:DEBIAN-CVE-2026-56364",
"products": [
{
"name": {
"value": "imagemagick",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8:7.1.1.43+dfsg1-1+deb13u11",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "8:7.1.1.43+dfsg1-1",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u1",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u10",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u2",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u3",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u4",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u5",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u6",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u7",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u8",
"evidence": "/affected/0/versions"
},
{
"value": "8:7.1.1.43+dfsg1-1+deb13u9",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "imagemagick",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8:7.1.2.13+dfsg1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "8:7.1.1.43+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "8:7.1.1.46+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "8:7.1.1.47+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "8:7.1.1.47+dfsg1-2",
"evidence": "/affected/1/versions"
},
{
"value": "8:7.1.2.1+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "8:7.1.2.12+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "8:7.1.2.3+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "8:7.1.2.7+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "8:7.1.2.8+dfsg1-1",
"evidence": "/affected/1/versions"
}
]
}
],
"severity": "low",
"structured": {
"id": "DEBIAN-CVE-2026-56364",
"aliases": [
"DEBIAN-CVE-2026-56364"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8:7.1.1.43+dfsg1-1+deb13u11"
}
]
}
],
"package": {
"name": "imagemagick",
"purl": "pkg:deb/debian/imagemagick?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"8:7.1.1.43+dfsg1-1",
"8:7.1.1.43+dfsg1-1+deb13u1",
"8:7.1.1.43+dfsg1-1+deb13u10",
"8:7.1.1.43+dfsg1-1+deb13u2",
"8:7.1.1.43+dfsg1-1+deb13u3",
"8:7.1.1.43+dfsg1-1+deb13u4",
"8:7.1.1.43+dfsg1-1+deb13u5",
"8:7.1.1.43+dfsg1-1+deb13u6",
"8:7.1.1.43+dfsg1-1+deb13u7",
"8:7.1.1.43+dfsg1-1+deb13u8",
"8:7.1.1.43+dfsg1-1+deb13u9"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56364.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8:7.1.2.13+dfsg1-1"
}
]
}
],
"package": {
"name": "imagemagick",
"purl": "pkg:deb/debian/imagemagick?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8:7.1.1.43+dfsg1-1",
"8:7.1.1.46+dfsg1-1",
"8:7.1.1.47+dfsg1-1",
"8:7.1.1.47+dfsg1-2",
"8:7.1.2.1+dfsg1-1",
"8:7.1.2.12+dfsg1-1",
"8:7.1.2.3+dfsg1-1",
"8:7.1.2.7+dfsg1-1",
"8:7.1.2.8+dfsg1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56364.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T11:47:29.448375016Z",
"provider": "osv",
"upstream": [
"CVE-2026-56364"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-56364"
]
},
"related_cves": [
{
"value": "CVE-2026-56364",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 450795,
"published_at": "2026-06-30T23:17:31.397+00:00"
}