CVE-2026-56361

What it actually does

ImageMagick versions before 7.1.2-19 contain an off-by-one error in morphology parameter validation. Malformed morphology arguments can cause the image-processing code to access memory just outside the intended heap buffer, resulting in an out-of-bounds heap read and likely process crash. Based on the published scoring, the expected impact is limited availability degradation rather than data theft or code execution, and exploitation requires local execution or a user-assisted workflow that causes ImageMagick to process attacker-controlled morphology parameters.

Why it matters to the business

The most likely business impact is disruption of image conversion, thumbnail generation, document rendering, or media-processing workflows that rely on ImageMagick. In applications where image processing is part of uploads, publishing, moderation, or customer-facing content pipelines, exploitation could cause failed jobs, worker crashes, degraded service availability, or operational noise. The vulnerability is not listed in CISA KEV, is not known to be used in ransomware campaigns, has very low EPSS, and currently has no reported exploit maturity, so urgency is lower than for actively exploited remote code execution issues; however, ImageMagick is commonly embedded in many products and automation pipelines, so organizations should still patch during the next normal maintenance cycle or sooner for internet-facing upload services.

How an attack unfolds

An attacker first identifies a workflow where ImageMagick processes attacker-influenced content or command parameters, such as an upload pipeline, conversion service, desktop workflow, batch-processing job, or scripted use of morphology operations. The attacker then supplies malformed morphology parameters that exploit the off-by-one validation defect. When ImageMagick parses and applies the morphology operation, it reads just outside the expected heap buffer boundary. This can trigger a memory access violation and crash the ImageMagick process or the worker process invoking it. In server-side pipelines, repeated submissions could be used to cause job failures or intermittent denial of service. There is currently no public indication from the provided data that this vulnerability enables reliable arbitrary code execution, credential access, or ransomware deployment.

How to fix it

Upgrade ImageMagick to version 7.1.2-19 or later. Where ImageMagick is supplied by an operating-system package manager, apply the vendor security update once available and verify that the installed package includes the upstream fix. For embedded or bundled copies, rebuild dependent applications and containers so they no longer include pre-7.1.2-19 ImageMagick libraries or binaries. As interim mitigations, avoid processing untrusted morphology parameters, restrict user-controllable ImageMagick command-line options, run ImageMagick in a sandboxed low-privilege worker, enforce resource limits, disable unnecessary coders/delegates in policy.xml, and isolate upload/conversion workers so crashes do not affect broader application availability.

How to confirm the fix worked

Confirm the installed ImageMagick version is 7.1.2-19 or later using commands such as `magick -version`, `convert -version`, package-manager inventory, container image inspection, or software composition analysis. Validate that all runtime paths use the patched binary or library, including background workers, containers, CI/CD images, desktop utilities, and bundled application dependencies. Run regression tests for image conversion and morphology operations and confirm malformed morphology inputs are rejected or handled without crashes. Review crash telemetry after patching to ensure there are no recurring segmentation faults, aborts, or heap-buffer-overflow reports associated with ImageMagick morphology processing.

Typical attack path

1. Identify an application, script, service, or user workflow that invokes ImageMagick morphology operations on untrusted or attacker-supplied input.
2. Submit or persuade a user/process to handle crafted image-processing input containing malformed morphology parameters.
3. ImageMagick validates the morphology parameters incorrectly due to an off-by-one error.
4. The morphology operation performs an out-of-bounds heap read or single-pixel memory access outside the intended buffer.
5. The ImageMagick process, worker, or calling application experiences a crash or processing failure.
6. The attacker repeats the input to disrupt image-processing availability or trigger operational instability.

How to detect it

To determine whether this vulnerability was already exercised, review application logs, media-processing job logs, worker supervisor logs, endpoint detection telemetry, and system crash logs for ImageMagick failures involving morphology operations. Look for segmentation faults, aborts, core dumps, heap-buffer-overflow or out-of-bounds read diagnostics, and repeated crashes of ImageMagick binaries such as `magick`, `convert`, or `mogrify` shortly after processing untrusted uploads or batch jobs. On Linux, check syslog, journald, kernel logs, coredumpctl, container runtime logs, and application worker logs. On Windows, review Application event logs, Windows Error Reporting artifacts, EDR crash telemetry, and application-specific conversion logs. If AddressSanitizer, hardened malloc, or crash reporting is enabled, search for references to heap-buffer-overflow, out-of-bounds heap reads, or ImageMagick morphology code paths. Correlate crash times with submitted files, job parameters, source IPs, user accounts, or queues to identify repeated triggering attempts. Because no known exploitation campaign or stable public exploit is indicated, detection should focus on crash patterns and anomalous morphology usage rather than actor-specific infrastructure.

• ImageMagick version 7.1.2-18
• ImageMagick version 7.1.2-17
• ImageMagick version 7.1.2-16
• heap-buffer-overflow
• out-of-bounds heap read
• AddressSanitizer: heap-buffer-overflow
• MagickCore/morphology.c
• -morphology
• Segmentation fault.*magick
• Segmentation fault.*convert
• Segmentation fault.*mogrify
• SIGSEGV.*magick
• SIGSEGV.*convert
• SIGSEGV.*mogrify
• core dumped.*magick
• core dumped.*convert
• core dumped.*mogrify

What your security team should do

• Inventory ImageMagick installations and bundled dependencies across servers, containers, developer workstations, build images, and third-party applications.
• Prioritize patching internet-facing upload, media conversion, document preview, and batch-processing services before lower-risk desktop or internal-only uses.
• Upgrade all affected deployments to ImageMagick 7.1.2-19 or later, or apply the equivalent vendor backport.
• Restrict or sanitize user-controllable ImageMagick options, especially morphology-related parameters, until patching is complete.
• Run ImageMagick workers with least privilege, process isolation, resource limits, and crash supervision to reduce denial-of-service impact.
• Search logs and endpoint telemetry for recent ImageMagick crashes, heap-buffer-overflow diagnostics, or repeated failed image-processing jobs involving morphology operations.
• Monitor vendor advisories for downstream packages that bundle ImageMagick and refresh container/base images that may retain vulnerable versions.