{"id":"CVE-2026-56366","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-56366","generatedAt":"2026-10-28T02:10:02.112Z","title":"ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths.","description":"ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.","published":"2026-07-10T15:16:43.000Z","lastModified":"2026-10-25T15:10:00.000Z","status":"Analyzed","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":4.8,"severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-401"],"affected":["imagemagick/imagemagick"],"epss":{"score":0.00169,"percentile":0.0628,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7","tags":["Vendor Advisory"],"source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-meta-reader-app1jpeg-error-path","tags":["Third Party Advisory"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-56366","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}