CVE-2026-56364: ImageMagick OpenCL Memory Leak Vulnerability - Low Severity

Technical summary

The vulnerability exists in the LoadOpenCLDeviceBenchmark() function within ImageMagick, which parses XML files defining OpenCL device profiles. The function fails to properly clean up allocated memory when encountering malformed XML—specifically, device elements that lack proper closing tags. The memory leak occurs during parsing, and repeated exposure to such files compounds the issue. An attacker with write permissions to the OpenCL device cache directory (typically a system or user-specific cache location) can craft malicious XML files triggering the leak. The vulnerability is classified under CWE-401 (Missing Release of Memory after Effective Lifetime), a straightforward memory management defect.

Business impact

The practical business impact is limited. The attack requires local file system write access to a specific cache directory and elevated privileges, making opportunistic exploitation unlikely. However, in multi-tenant environments or systems where non-administrative users have write access to shared cache directories, a malicious insider could degrade service availability by exhausting memory resources. For organizations running ImageMagick in containerized or isolated environments with strict permission controls, this poses minimal risk. The CVSS score of 1.9 (LOW) reflects the high privilege and access requirements needed to mount an attack.

Affected systems

ImageMagick installations prior to version 7.1.2-13 are vulnerable. This includes all releases from the 7.1.x branch up to but not including 7.1.2-13, and likely earlier major versions. Organizations should verify their specific ImageMagick deployment version and check vendor advisories for comprehensive affected-version details. OpenCL support must be compiled into ImageMagick for the vulnerable code path to be reachable.

Exploitability

Exploitability is low in typical deployments. An attacker requires: (1) write access to the OpenCL cache directory, (2) high privileges on the host system (reflected in the 'PR:H' component of the CVSS vector), and (3) ability to trigger ImageMagick to read the malicious XML file. The attack is not remotely exploitable and demands local system access. This vulnerability is not tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no active in-the-wild exploitation has been documented. Spontaneous discovery and exploitation by unauthenticated attackers is extremely unlikely.

Remediation

Upgrade ImageMagick to version 7.1.2-13 or later. Organizations should verify the exact patch version against official ImageMagick releases and security advisories before deployment. Additionally, restrict write access to OpenCL cache directories using file system permissions, allowing only the ImageMagick process owner to write to these locations. In defense-in-depth approaches, monitor cache directories for unexpected XML files and implement resource limits (memory quotas) on ImageMagick processes to mitigate denial-of-service impact if a leak were to occur.

Patch guidance

Apply updates distributed by the ImageMagick project. Verify patch availability through the official ImageMagick repository or your Linux distribution's package manager. Test patches in non-production environments first, particularly if ImageMagick is deeply integrated into image processing pipelines. Given the low severity and specific privilege requirements, patching can be scheduled during regular maintenance windows rather than treated as an emergency. Monitor vendor advisories for confirmation that version 7.1.2-13 addresses this specific issue.

Detection guidance

Monitor ImageMagick process memory usage for unusual growth patterns, particularly if the application processes XML-based configuration files from untrusted sources. Audit write permissions on OpenCL cache directories (typically under ~/.cache or system-wide cache paths) to ensure only authorized users can modify contents. Log access to OpenCL device profile files and alert on unexpected XML files appearing in these locations. If available, enable application-level logging in ImageMagick to track file parsing operations.

Why prioritize this

This vulnerability merits low priority in most security programs. The combination of high privilege requirements, need for local file system write access, limited exploitability in the wild (no KEV listing), and modest severity (CVSS 1.9) means it poses minimal immediate threat to typical deployments. Prioritize patching for systems in high-control environments where privilege boundaries are weak or cache directories are world-writable. Organizations should address it as part of routine patching cycles rather than allocating emergency response resources.

Risk score, explained

The CVSS 3.1 score of 1.9 (LOW) reflects the confluence of limiting factors: Attack Vector is Local (not network-reachable), Attack Complexity is High (requires specific conditions), Privilege level is High (attacker must have significant system access), no User Interaction is required, and the scope is Unchanged with only an Availability impact (denial of service via memory exhaustion). While memory leaks are serious in principle, the barriers to exploitation—particularly privilege and access requirements—substantially reduce exploitability in real-world scenarios.

Frequently asked questions