ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.
{
"license": "CC-BY-4.0",
"sources": [
{
"imported": "2026-07-30T14:08:48.128Z",
"html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56376",
"modified": "2026-06-24T14:41:30.637Z",
"url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-56376",
"database_specific": {
"status": "Analyzed"
},
"id": "CVE-2026-56376",
"published": "2026-06-23T13:16:46.397Z"
},
{
"html_url": "https://github.com/advisories/GHSA-8g9f-ccmr-vfvg",
"imported": "2026-07-30T14:09:10.912Z",
"modified": "2026-06-23T15:32:49Z",
"url": "https://api.github.com/advisories/GHSA-8g9f-ccmr-vfvg",
"id": "GHSA-8g9f-ccmr-vfvg",
"published": "2026-06-23T15:32:37Z"
},
{
"html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38440",
"imported": "2026-07-30T14:08:53.169Z",
"modified": "2026-06-23T13:06:10Z",
"url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-38440",
"id": "EUVD-2026-38440",
"published": "2026-06-23T12:13:04Z"
}
]
}