CVE-2026-56361: ImageMagick Off-By-One Heap Buffer Read Vulnerability

Technical summary

An off-by-one error in ImageMagick's morphology validation logic fails to properly bounds-check array indices, resulting in out-of-bounds heap buffer read access. The vulnerability is triggered when morphology operations receive incorrectly specified parameters, causing the code to access memory one position beyond the allocated buffer. This manifests as a heap buffer read overflow rather than write, limiting immediate code execution risk but enabling information disclosure through memory content leakage.

Business impact

The information disclosure potential of this vulnerability is constrained by its low CVSS score and local attack vector. Organizations should not expect operational disruption or widespread risk unless ImageMagick processes untrusted image files from external sources in security-sensitive contexts. However, environments where users routinely work with user-supplied images or where batch image processing occurs may face incremental risk of memory content leakage.

Affected systems

ImageMagick prior to version 7.1.2-19 is affected. Organizations should inventory deployments where ImageMagick is installed as a library dependency, embedded in web applications, or used for command-line image processing. Common affected contexts include legacy web applications with image upload functionality, content management systems using ImageMagick for thumbnail generation, and server-side image processing pipelines.

Exploitability

Exploitation requires local access and user interaction; an attacker must either convince a local user to process a malicious image or have direct ability to supply morphology parameters to an ImageMagick operation. The single-pixel read scope means reliable exploitation for meaningful data extraction is difficult and non-deterministic. No public exploit code or weaponized attack vectors are known, and the vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update ImageMagick to version 7.1.2-19 or later. Verify the update is applied to all systems running ImageMagick, including embedded instances within application dependencies. Test functionality after patching, as morphology operations may be affected by the validation fix. For systems unable to patch immediately, restrict local user access to ImageMagick and disable morphology-based image processing workflows if operationally feasible.

Patch guidance

Upgrade ImageMagick to 7.1.2-19 or any subsequent release. Verify patch installation using the ImageMagick version command (identify -version or convert -version). Update package managers on Linux systems (apt, yum, brew) to retrieve the patched version. For environments where ImageMagick is embedded in application dependencies, check software bill of materials (SBOM) and coordinate application updates with vendors. After patching, confirm that image processing workflows continue to function correctly, particularly those using morphology operations.

Detection guidance

Review system inventory for ImageMagick installations and version numbers. Check application and library dependencies for bundled ImageMagick versions. Monitor for image processing errors or memory access warnings in application logs following the CVE publication. Detect exploitation attempts indirectly by monitoring for segmentation faults or memory access violations in processes using ImageMagick, though this is non-specific. Evaluate whether your organization's threat model includes scenarios where local attackers can supply morphology parameters to ImageMagick.

Why prioritize this

Despite affecting a widely-used image processing library, this vulnerability merits lower priority due to its limited scope: off-by-one reads are inherently difficult to exploit reliably, the attack requires local access and user interaction, information disclosure is constrained to a single pixel's worth of memory, and no active exploitation is documented. Prioritize patching systems that expose morphology functionality to untrusted input or where batch image processing from external sources occurs, but standard deployments can follow regular patch schedules.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects the constrained attack vector (local only), required user interaction, and limited impact (availability only, via memory access violation). The off-by-one nature of the flaw prevents reliable information disclosure or code execution, keeping the severity low despite being a real memory safety issue. Organizations with strong local access controls and limited user-supplied image processing face minimal practical risk.

Frequently asked questions