---
id: CVE-2026-56366
title: ImageMagick - Memory Leak in META Reader APP1JPEG Error Path
summary: >-
  ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META
  reader when processing APP1JPEG input paths. Attackers can trigger this memory
  leak by providing specially crafted APP1JPEG image files, causing denial of
  servi…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-401
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick >= 7.0.0 < 7.1.2-18
  - ImageMagick < 6.9.13-43
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-14T01:45:40.341590Z'
published: '2026-07-10'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:51.873Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56366'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7
    label: GitHub Security Advisory (GHSA-9r56-3gjq-hqf7)
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-meta-reader-app1jpeg-error-path
    label: >-
      VulnCheck Advisory: ImageMagick - Memory Leak in META Reader APP1JPEG
      Error Path
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.06349
ingestedAt: '2026-11-03T08:39:35.560Z'
---

## Overview

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.

## Affected

- `ImageMagick >= 7.0.0 < 7.1.2-18`
- `ImageMagick < 6.9.13-43`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.