---
id: CVE-2026-56368
title: ImageMagick - Memory Leak in Raw Pixel Data Coders
summary: >-
  ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple
  coders that write raw pixel data where allocated objects are not properly
  freed. Attackers can trigger this leak by processing specially crafted images,
  causing…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-401
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick >= 7.0.0 < 7.1.2-15
  - ImageMagick < 6.9.13-40
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-24T13:37:57.353115Z'
published: '2026-06-24'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:52.559Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56368'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc
    label: GitHub Security Advisory (GHSA-wfx3-6g53-9fgc)
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders
    label: 'VulnCheck Advisory: ImageMagick - Memory Leak in Raw Pixel Data Coders'
tags:
  - cve.org
epss: 0.0046
epssPercentile: 0.40038
ingestedAt: '2026-11-03T08:39:35.561Z'
---

## Overview

ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.

## Affected

- `ImageMagick >= 7.0.0 < 7.1.2-15`
- `ImageMagick < 6.9.13-40`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.